@prosopo/user-access-policy 3.3.0 → 3.3.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +36 -0
- package/dist/accessPolicy.js +71 -57
- package/dist/accessPolicyResolver.js +62 -36
- package/dist/accessRules.js +9 -6
- package/dist/api/accessRuleApiRoutes.js +73 -50
- package/dist/api/deleteAllRulesEndpoint.js +22 -19
- package/dist/api/deleteRulesEndpoint.js +30 -27
- package/dist/api/insertRulesEndpoint.js +57 -57
- package/dist/index.js +27 -14
- package/dist/redis/redisAccessRules.js +128 -112
- package/dist/redis/redisAccessRulesIndex.js +94 -70
- package/dist/redis/redisIndex.js +15 -16
- package/dist/util.js +4 -2
- package/package.json +15 -10
- package/vite.cjs.config.ts +7 -6
- package/vite.esm.config.ts +20 -0
- package/vite.test.config.ts +16 -21
- package/dist/accessPolicy.d.ts +0 -169
- package/dist/accessPolicy.d.ts.map +0 -1
- package/dist/accessPolicy.js.map +0 -1
- package/dist/accessPolicyResolver.d.ts +0 -115
- package/dist/accessPolicyResolver.d.ts.map +0 -1
- package/dist/accessPolicyResolver.js.map +0 -1
- package/dist/accessRules.d.ts +0 -16
- package/dist/accessRules.d.ts.map +0 -1
- package/dist/accessRules.js.map +0 -1
- package/dist/api/accessRuleApiRoutes.d.ts +0 -27
- package/dist/api/accessRuleApiRoutes.d.ts.map +0 -1
- package/dist/api/accessRuleApiRoutes.js.map +0 -1
- package/dist/api/deleteAllRulesEndpoint.d.ts +0 -12
- package/dist/api/deleteAllRulesEndpoint.d.ts.map +0 -1
- package/dist/api/deleteAllRulesEndpoint.js.map +0 -1
- package/dist/api/deleteRulesEndpoint.d.ts +0 -116
- package/dist/api/deleteRulesEndpoint.d.ts.map +0 -1
- package/dist/api/deleteRulesEndpoint.js.map +0 -1
- package/dist/api/insertRulesEndpoint.d.ts +0 -22
- package/dist/api/insertRulesEndpoint.d.ts.map +0 -1
- package/dist/api/insertRulesEndpoint.js.map +0 -1
- package/dist/index.d.ts +0 -15
- package/dist/index.d.ts.map +0 -1
- package/dist/index.js.map +0 -1
- package/dist/redis/redisAccessRules.d.ts +0 -7
- package/dist/redis/redisAccessRules.d.ts.map +0 -1
- package/dist/redis/redisAccessRules.js.map +0 -1
- package/dist/redis/redisAccessRulesIndex.d.ts +0 -13
- package/dist/redis/redisAccessRulesIndex.d.ts.map +0 -1
- package/dist/redis/redisAccessRulesIndex.js.map +0 -1
- package/dist/redis/redisIndex.d.ts +0 -9
- package/dist/redis/redisIndex.d.ts.map +0 -1
- package/dist/redis/redisIndex.js.map +0 -1
- package/dist/tests/accessPolicy.test.d.ts +0 -2
- package/dist/tests/accessPolicy.test.d.ts.map +0 -1
- package/dist/tests/accessPolicy.test.js +0 -27
- package/dist/tests/accessPolicy.test.js.map +0 -1
- package/dist/tests/redis/redisAccessRules.test.d.ts +0 -2
- package/dist/tests/redis/redisAccessRules.test.d.ts.map +0 -1
- package/dist/tests/redis/redisAccessRules.test.js +0 -413
- package/dist/tests/redis/redisAccessRules.test.js.map +0 -1
- package/dist/tests/redis/redisIndex.test.d.ts +0 -2
- package/dist/tests/redis/redisIndex.test.d.ts.map +0 -1
- package/dist/tests/redis/redisIndex.test.js +0 -84
- package/dist/tests/redis/redisIndex.test.js.map +0 -1
- package/dist/tests/redis/testRedisClient.d.ts +0 -3
- package/dist/tests/redis/testRedisClient.d.ts.map +0 -1
- package/dist/tests/redis/testRedisClient.js +0 -8
- package/dist/tests/redis/testRedisClient.js.map +0 -1
- package/dist/tests/testLogger.d.ts +0 -4
- package/dist/tests/testLogger.d.ts.map +0 -1
- package/dist/tests/testLogger.js +0 -22
- package/dist/tests/testLogger.js.map +0 -1
- package/dist/util.d.ts +0 -2
- package/dist/util.d.ts.map +0 -1
- package/dist/util.js.map +0 -1
- package/vite.config.ts +0 -39
|
@@ -1,62 +1,62 @@
|
|
|
1
|
-
import { ApiEndpointResponseStatus
|
|
2
|
-
import {
|
|
1
|
+
import { ApiEndpointResponseStatus } from "@prosopo/api-route";
|
|
2
|
+
import { getLogger, LogLevel } from "@prosopo/common";
|
|
3
3
|
import { z } from "zod";
|
|
4
|
-
import {
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
.number()
|
|
11
|
-
.optional()
|
|
12
|
-
.transform((val) => (val !== undefined ? Math.floor(val) : val)),
|
|
4
|
+
import { userScopeInputSchema, policyScopeSchema, accessPolicySchema } from "../accessPolicy.js";
|
|
5
|
+
const insertRulesEndpointSchema = z.object({
|
|
6
|
+
accessPolicy: accessPolicySchema,
|
|
7
|
+
policyScope: policyScopeSchema.optional(),
|
|
8
|
+
userScopes: z.array(userScopeInputSchema),
|
|
9
|
+
expirationTimestamp: z.number().optional().transform((val) => val !== void 0 ? Math.floor(val) : val)
|
|
13
10
|
});
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
});
|
|
25
|
-
}, 5000);
|
|
26
|
-
});
|
|
27
|
-
const createRulesPromise = this.createRules(args)
|
|
28
|
-
.then(() => ({
|
|
29
|
-
status: ApiEndpointResponseStatus.SUCCESS,
|
|
30
|
-
}))
|
|
31
|
-
.catch((error) => {
|
|
32
|
-
if (logger?.getLogLevel() === LogLevel.enum.debug) {
|
|
33
|
-
logger.error(() => ({
|
|
34
|
-
err: error,
|
|
35
|
-
data: { args },
|
|
36
|
-
msg: "Failed to insert access rules",
|
|
37
|
-
}));
|
|
38
|
-
}
|
|
39
|
-
return {
|
|
40
|
-
status: ApiEndpointResponseStatus.FAIL,
|
|
41
|
-
};
|
|
11
|
+
class InsertRulesEndpoint {
|
|
12
|
+
constructor(accessRulesWriter) {
|
|
13
|
+
this.accessRulesWriter = accessRulesWriter;
|
|
14
|
+
}
|
|
15
|
+
async processRequest(args, logger) {
|
|
16
|
+
logger = logger || getLogger(LogLevel.enum.info, "InsertRulesEndpoint");
|
|
17
|
+
const timeoutPromise = new Promise((resolve) => {
|
|
18
|
+
setTimeout(() => {
|
|
19
|
+
resolve({
|
|
20
|
+
status: ApiEndpointResponseStatus.PROCESSING
|
|
42
21
|
});
|
|
43
|
-
|
|
44
|
-
}
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
}
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
22
|
+
}, 5e3);
|
|
23
|
+
});
|
|
24
|
+
const createRulesPromise = this.createRules(args).then(() => ({
|
|
25
|
+
status: ApiEndpointResponseStatus.SUCCESS
|
|
26
|
+
})).catch((error) => {
|
|
27
|
+
if (logger?.getLogLevel() === LogLevel.enum.debug) {
|
|
28
|
+
logger.error(() => ({
|
|
29
|
+
err: error,
|
|
30
|
+
data: { args },
|
|
31
|
+
msg: "Failed to insert access rules"
|
|
32
|
+
}));
|
|
33
|
+
}
|
|
34
|
+
return {
|
|
35
|
+
status: ApiEndpointResponseStatus.FAIL
|
|
36
|
+
};
|
|
37
|
+
});
|
|
38
|
+
return Promise.race([timeoutPromise, createRulesPromise]);
|
|
39
|
+
}
|
|
40
|
+
getRequestArgsSchema() {
|
|
41
|
+
return insertRulesEndpointSchema;
|
|
42
|
+
}
|
|
43
|
+
async createRules(args) {
|
|
44
|
+
const policyScope = args.policyScope || {};
|
|
45
|
+
const createPromises = [];
|
|
46
|
+
for (const userScope of args.userScopes) {
|
|
47
|
+
const rule = {
|
|
48
|
+
...args.accessPolicy,
|
|
49
|
+
...policyScope,
|
|
50
|
+
...userScope
|
|
51
|
+
};
|
|
52
|
+
createPromises.push(
|
|
53
|
+
this.accessRulesWriter.insertRule(rule, args.expirationTimestamp)
|
|
54
|
+
);
|
|
60
55
|
}
|
|
56
|
+
return Promise.all(createPromises);
|
|
57
|
+
}
|
|
61
58
|
}
|
|
62
|
-
|
|
59
|
+
export {
|
|
60
|
+
InsertRulesEndpoint,
|
|
61
|
+
insertRulesEndpointSchema
|
|
62
|
+
};
|
package/dist/index.js
CHANGED
|
@@ -1,15 +1,28 @@
|
|
|
1
|
-
import { AccessPolicyType, accessPolicySchema, policyScopeSchema, } from "
|
|
2
|
-
import {
|
|
3
|
-
import {
|
|
4
|
-
import {
|
|
5
|
-
import { deleteAllRulesEndpointSchema
|
|
6
|
-
import { deleteRulesEndpointSchema
|
|
7
|
-
import { insertRulesEndpointSchema
|
|
8
|
-
import { createRedisAccessRulesStorage } from "
|
|
9
|
-
import { createRedisAccessRulesIndex } from "
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
1
|
+
import { AccessPolicyType, accessPolicySchema, policyScopeSchema, userScopeInputSchema } from "./accessPolicy.js";
|
|
2
|
+
import { ScopeMatch, createAccessPolicyResolver } from "./accessPolicyResolver.js";
|
|
3
|
+
import { AccessRuleApiRoutes } from "./api/accessRuleApiRoutes.js";
|
|
4
|
+
import { accessRuleApiPaths, getExpressApiRuleRateLimits } from "./api/accessRuleApiRoutes.js";
|
|
5
|
+
import { deleteAllRulesEndpointSchema } from "./api/deleteAllRulesEndpoint.js";
|
|
6
|
+
import { deleteRulesEndpointSchema } from "./api/deleteRulesEndpoint.js";
|
|
7
|
+
import { insertRulesEndpointSchema } from "./api/insertRulesEndpoint.js";
|
|
8
|
+
import { createRedisAccessRulesStorage } from "./redis/redisAccessRules.js";
|
|
9
|
+
import { createRedisAccessRulesIndex } from "./redis/redisAccessRulesIndex.js";
|
|
10
|
+
const createApiRuleRoutesProvider = (rulesStorage) => {
|
|
11
|
+
return new AccessRuleApiRoutes(rulesStorage);
|
|
12
|
+
};
|
|
13
|
+
export {
|
|
14
|
+
AccessPolicyType,
|
|
15
|
+
ScopeMatch,
|
|
16
|
+
accessPolicySchema,
|
|
17
|
+
accessRuleApiPaths,
|
|
18
|
+
createAccessPolicyResolver,
|
|
19
|
+
createApiRuleRoutesProvider,
|
|
20
|
+
createRedisAccessRulesIndex,
|
|
21
|
+
createRedisAccessRulesStorage,
|
|
22
|
+
deleteAllRulesEndpointSchema,
|
|
23
|
+
deleteRulesEndpointSchema,
|
|
24
|
+
getExpressApiRuleRateLimits,
|
|
25
|
+
insertRulesEndpointSchema,
|
|
26
|
+
policyScopeSchema,
|
|
27
|
+
userScopeInputSchema
|
|
13
28
|
};
|
|
14
|
-
export { createAccessPolicyResolver, AccessPolicyType, ScopeMatch, createRedisAccessRulesIndex, createRedisAccessRulesStorage, accessRuleApiPaths, accessPolicySchema, policyScopeSchema, insertRulesEndpointSchema, deleteAllRulesEndpointSchema, deleteRulesEndpointSchema, getExpressApiRuleRateLimits, userScopeInputSchema, };
|
|
15
|
-
//# sourceMappingURL=index.js.map
|
|
@@ -1,119 +1,135 @@
|
|
|
1
1
|
import * as util from "node:util";
|
|
2
|
-
import { accessRuleSchema
|
|
3
|
-
import {
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
2
|
+
import { accessRuleSchema } from "../accessRules.js";
|
|
3
|
+
import { getRedisAccessRulesQuery, accessRulesRedisIndexName, accessRulesRedisSearchOptions, accessRuleRedisKeyPrefix, getRedisAccessRuleKey, getRedisAccessRuleValue } from "./redisAccessRulesIndex.js";
|
|
4
|
+
const createRedisAccessRulesReader = (client, logger) => {
|
|
5
|
+
return {
|
|
6
|
+
findRules: async (filter, skipEmptyUserScopes = true) => {
|
|
7
|
+
const query = getRedisAccessRulesQuery(filter);
|
|
8
|
+
if (skipEmptyUserScopes && query === "ismissing(@clientId)") {
|
|
9
|
+
return [];
|
|
10
|
+
}
|
|
11
|
+
let searchReply;
|
|
12
|
+
try {
|
|
13
|
+
searchReply = await client.ft.search(
|
|
14
|
+
accessRulesRedisIndexName,
|
|
15
|
+
query,
|
|
16
|
+
accessRulesRedisSearchOptions
|
|
17
|
+
);
|
|
18
|
+
if (searchReply.total > 0) {
|
|
19
|
+
logger.debug(() => ({
|
|
20
|
+
msg: "Executed search query",
|
|
21
|
+
data: {
|
|
22
|
+
inspect: util.inspect(
|
|
23
|
+
{
|
|
24
|
+
filter,
|
|
25
|
+
searchReply,
|
|
26
|
+
query
|
|
27
|
+
},
|
|
28
|
+
{ depth: null }
|
|
29
|
+
)
|
|
10
30
|
}
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
return [];
|
|
64
|
-
}
|
|
65
|
-
return searchReply.documents;
|
|
66
|
-
},
|
|
67
|
-
};
|
|
31
|
+
}));
|
|
32
|
+
}
|
|
33
|
+
} catch (e) {
|
|
34
|
+
logger.error(() => ({
|
|
35
|
+
err: e,
|
|
36
|
+
data: {
|
|
37
|
+
inspect: util.inspect(
|
|
38
|
+
{
|
|
39
|
+
query,
|
|
40
|
+
filter
|
|
41
|
+
},
|
|
42
|
+
{
|
|
43
|
+
depth: null
|
|
44
|
+
}
|
|
45
|
+
)
|
|
46
|
+
},
|
|
47
|
+
msg: "failed to execute search query"
|
|
48
|
+
}));
|
|
49
|
+
return [];
|
|
50
|
+
}
|
|
51
|
+
return extractAccessRulesFromSearchReply(searchReply, logger);
|
|
52
|
+
},
|
|
53
|
+
findRuleIds: async (filter) => {
|
|
54
|
+
const query = getRedisAccessRulesQuery(filter);
|
|
55
|
+
let searchReply;
|
|
56
|
+
try {
|
|
57
|
+
searchReply = await client.ft.searchNoContent(
|
|
58
|
+
accessRulesRedisIndexName,
|
|
59
|
+
query,
|
|
60
|
+
accessRulesRedisSearchOptions
|
|
61
|
+
);
|
|
62
|
+
} catch (e) {
|
|
63
|
+
logger.error(() => ({
|
|
64
|
+
err: e,
|
|
65
|
+
data: {
|
|
66
|
+
inspect: util.inspect(
|
|
67
|
+
{
|
|
68
|
+
query,
|
|
69
|
+
filter
|
|
70
|
+
},
|
|
71
|
+
{
|
|
72
|
+
depth: null
|
|
73
|
+
}
|
|
74
|
+
)
|
|
75
|
+
},
|
|
76
|
+
msg: "Failed to execute search query for rule IDs"
|
|
77
|
+
}));
|
|
78
|
+
return [];
|
|
79
|
+
}
|
|
80
|
+
return searchReply.documents;
|
|
81
|
+
}
|
|
82
|
+
};
|
|
68
83
|
};
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
},
|
|
94
|
-
};
|
|
84
|
+
const createRedisAccessRulesWriter = (client) => {
|
|
85
|
+
return {
|
|
86
|
+
insertRule: async (rule, expirationTimestamp) => {
|
|
87
|
+
const ruleKey = getRedisAccessRuleKey(rule);
|
|
88
|
+
const ruleValue = getRedisAccessRuleValue(rule);
|
|
89
|
+
await client.hSet(ruleKey, ruleValue);
|
|
90
|
+
if (expirationTimestamp) {
|
|
91
|
+
const expiryDate = new Date(expirationTimestamp);
|
|
92
|
+
if (expiryDate.getUTCFullYear() === 1970) {
|
|
93
|
+
await client.expireAt(ruleKey, expirationTimestamp);
|
|
94
|
+
} else {
|
|
95
|
+
const timestampInSeconds = Math.floor(expirationTimestamp / 1e3);
|
|
96
|
+
await client.expireAt(ruleKey, timestampInSeconds);
|
|
97
|
+
}
|
|
98
|
+
}
|
|
99
|
+
return ruleKey;
|
|
100
|
+
},
|
|
101
|
+
deleteRules: async (ruleIds) => void await client.del(ruleIds),
|
|
102
|
+
deleteAllRules: async () => {
|
|
103
|
+
const keys = await client.keys(`${accessRuleRedisKeyPrefix}*`);
|
|
104
|
+
if (keys.length === 0) return 0;
|
|
105
|
+
return await client.del(keys);
|
|
106
|
+
}
|
|
107
|
+
};
|
|
95
108
|
};
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
109
|
+
const createRedisAccessRulesStorage = (client, logger) => {
|
|
110
|
+
return {
|
|
111
|
+
...createRedisAccessRulesReader(client, logger),
|
|
112
|
+
...createRedisAccessRulesWriter(client)
|
|
113
|
+
};
|
|
101
114
|
};
|
|
102
115
|
const extractAccessRulesFromSearchReply = (searchReply, logger) => {
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
116
|
+
const accessRules = [];
|
|
117
|
+
searchReply.documents.map(({ id, value: document }) => {
|
|
118
|
+
const parsedDocument = accessRuleSchema.safeParse(document);
|
|
119
|
+
if (parsedDocument.success) {
|
|
120
|
+
accessRules.push(parsedDocument.data);
|
|
121
|
+
} else {
|
|
122
|
+
logger.debug(() => ({
|
|
123
|
+
msg: "Failed to parse access rule from search reply",
|
|
124
|
+
id,
|
|
125
|
+
error: parsedDocument.error
|
|
126
|
+
}));
|
|
127
|
+
}
|
|
128
|
+
});
|
|
129
|
+
return accessRules;
|
|
130
|
+
};
|
|
131
|
+
export {
|
|
132
|
+
createRedisAccessRulesReader,
|
|
133
|
+
createRedisAccessRulesStorage,
|
|
134
|
+
createRedisAccessRulesWriter
|
|
118
135
|
};
|
|
119
|
-
//# sourceMappingURL=redisAccessRules.js.map
|
|
@@ -1,89 +1,113 @@
|
|
|
1
1
|
import crypto from "node:crypto";
|
|
2
2
|
import { SCHEMA_FIELD_TYPE } from "@redis/search";
|
|
3
|
-
import { ScopeMatch } from "
|
|
4
|
-
import { createRedisIndex } from "
|
|
5
|
-
|
|
6
|
-
|
|
3
|
+
import { ScopeMatch } from "../accessPolicyResolver.js";
|
|
4
|
+
import { createRedisIndex } from "./redisIndex.js";
|
|
5
|
+
const accessRulesRedisIndexName = "index:user-access-rules";
|
|
6
|
+
const accessRuleRedisKeyPrefix = "uar:";
|
|
7
7
|
const accessRuleContentHashAlgorithm = "md5";
|
|
8
|
-
const DEFAULT_SEARCH_LIMIT =
|
|
8
|
+
const DEFAULT_SEARCH_LIMIT = 1e3;
|
|
9
9
|
const accessRulesIndex = {
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
options: {
|
|
25
|
-
ON: "HASH",
|
|
26
|
-
PREFIX: [accessRuleRedisKeyPrefix],
|
|
10
|
+
name: accessRulesRedisIndexName,
|
|
11
|
+
/**
|
|
12
|
+
* Note on the field type decision
|
|
13
|
+
*
|
|
14
|
+
* TAG is designed for the exact value matching
|
|
15
|
+
* TEXT is designed for the word-based and pattern matching
|
|
16
|
+
*
|
|
17
|
+
* For our goal TAG fits perfectly and, more performant
|
|
18
|
+
*/
|
|
19
|
+
schema: {
|
|
20
|
+
clientId: {
|
|
21
|
+
type: SCHEMA_FIELD_TYPE.TAG,
|
|
22
|
+
// necessary to make possible use of the ismissing() function on this field in the search
|
|
23
|
+
INDEXMISSING: true
|
|
27
24
|
},
|
|
25
|
+
numericIpMaskMin: SCHEMA_FIELD_TYPE.NUMERIC,
|
|
26
|
+
numericIpMaskMax: SCHEMA_FIELD_TYPE.NUMERIC,
|
|
27
|
+
userId: SCHEMA_FIELD_TYPE.TAG,
|
|
28
|
+
numericIp: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
|
|
29
|
+
ja4Hash: SCHEMA_FIELD_TYPE.TAG,
|
|
30
|
+
headersHash: SCHEMA_FIELD_TYPE.TAG,
|
|
31
|
+
userAgentHash: SCHEMA_FIELD_TYPE.TAG
|
|
32
|
+
},
|
|
33
|
+
// the satisfy statement is to guarantee that the keys are right
|
|
34
|
+
options: {
|
|
35
|
+
ON: "HASH",
|
|
36
|
+
PREFIX: [accessRuleRedisKeyPrefix]
|
|
37
|
+
}
|
|
28
38
|
};
|
|
29
|
-
|
|
39
|
+
const createRedisAccessRulesIndex = async (client) => createRedisIndex(client, accessRulesIndex);
|
|
30
40
|
const numericIndexFields = [
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
41
|
+
"numericIp",
|
|
42
|
+
"numericIpMaskMin",
|
|
43
|
+
"numericIpMaskMax"
|
|
34
44
|
];
|
|
35
45
|
const greedyFieldComparisons = {
|
|
36
|
-
|
|
46
|
+
numericIp: (value) => `( @numericIp:[${value}] | ( @numericIpMaskMin:[-inf ${value}] @numericIpMaskMax:[${value} +inf] ) )`
|
|
37
47
|
};
|
|
38
|
-
|
|
39
|
-
|
|
48
|
+
const accessRulesRedisSearchOptions = {
|
|
49
|
+
// #2 is a required option when the 'ismissing()' function is in the query body
|
|
50
|
+
DIALECT: 2
|
|
40
51
|
};
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
52
|
+
const accessRulesRedisDeleteOptions = {
|
|
53
|
+
// #2 is a required option when the 'ismissing()' function is in the query body
|
|
54
|
+
DIALECT: 2,
|
|
55
|
+
LIMIT: {
|
|
56
|
+
from: 0,
|
|
57
|
+
size: DEFAULT_SEARCH_LIMIT
|
|
58
|
+
}
|
|
47
59
|
};
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
60
|
+
const getRedisAccessRulesQuery = (filter) => {
|
|
61
|
+
const { policyScope, userScope } = filter;
|
|
62
|
+
const policyScopeFilter = getPolicyScopeQuery(
|
|
63
|
+
policyScope,
|
|
64
|
+
filter.policyScopeMatch
|
|
65
|
+
);
|
|
66
|
+
if (userScope && Object.keys(userScope).length > 0) {
|
|
67
|
+
const userScopeFilter = getUserScopeQuery(userScope, filter.userScopeMatch);
|
|
68
|
+
return `${policyScopeFilter} ( ${userScopeFilter} )`;
|
|
69
|
+
}
|
|
70
|
+
return policyScopeFilter ? policyScopeFilter : "*";
|
|
56
71
|
};
|
|
57
72
|
const getPolicyScopeQuery = (policyScope, scopeMatchType) => {
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
}
|
|
64
|
-
return ScopeMatch.Exact === scopeMatchType ? "ismissing(@clientId)" : "";
|
|
73
|
+
const clientId = policyScope?.clientId;
|
|
74
|
+
if ("string" === typeof clientId) {
|
|
75
|
+
return ScopeMatch.Exact === scopeMatchType ? `@clientId:{${clientId}}` : `( @clientId:{${clientId}} | ismissing(@clientId) )`;
|
|
76
|
+
}
|
|
77
|
+
return ScopeMatch.Exact === scopeMatchType ? "ismissing(@clientId)" : "";
|
|
65
78
|
};
|
|
66
79
|
const getUserScopeQuery = (userScope, scopeMatchType) => {
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
.join(scopeJoinType);
|
|
80
|
+
const scopeEntries = Object.entries(userScope).filter(([_, value]) => value !== void 0);
|
|
81
|
+
const scopeJoinType = ScopeMatch.Exact === scopeMatchType ? " " : " | ";
|
|
82
|
+
return scopeEntries.map(
|
|
83
|
+
([scopeFieldName, scopeFieldValue]) => getUserScopeFieldQuery(scopeFieldName, scopeFieldValue, scopeMatchType)
|
|
84
|
+
).join(scopeJoinType);
|
|
73
85
|
};
|
|
74
86
|
const getUserScopeFieldQuery = (fieldName, fieldValue, matchType) => {
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
87
|
+
if (ScopeMatch.Greedy === matchType && "function" === typeof greedyFieldComparisons[fieldName]) {
|
|
88
|
+
return greedyFieldComparisons[fieldName](fieldValue);
|
|
89
|
+
}
|
|
90
|
+
return numericIndexFields.includes(fieldName) ? `@${fieldName}:[${fieldValue}]` : `@${fieldName}:{${fieldValue}}`;
|
|
91
|
+
};
|
|
92
|
+
const getRedisAccessRuleKey = (rule) => accessRuleRedisKeyPrefix + crypto.createHash(accessRuleContentHashAlgorithm).update(
|
|
93
|
+
JSON.stringify(
|
|
94
|
+
rule,
|
|
95
|
+
(key, value) => (
|
|
96
|
+
// JSON.stringify can't handle BigInt itself: throws "Do not know how to serialize a BigInt"
|
|
97
|
+
"bigint" === typeof value ? value.toString() : value
|
|
98
|
+
)
|
|
99
|
+
)
|
|
100
|
+
).digest("hex");
|
|
101
|
+
const getRedisAccessRuleValue = (rule) => Object.fromEntries(
|
|
102
|
+
Object.entries(rule).map(([key, value]) => [key, String(value)])
|
|
103
|
+
);
|
|
104
|
+
export {
|
|
105
|
+
accessRuleRedisKeyPrefix,
|
|
106
|
+
accessRulesRedisDeleteOptions,
|
|
107
|
+
accessRulesRedisIndexName,
|
|
108
|
+
accessRulesRedisSearchOptions,
|
|
109
|
+
createRedisAccessRulesIndex,
|
|
110
|
+
getRedisAccessRuleKey,
|
|
111
|
+
getRedisAccessRuleValue,
|
|
112
|
+
getRedisAccessRulesQuery
|
|
82
113
|
};
|
|
83
|
-
export const getRedisAccessRuleKey = (rule) => accessRuleRedisKeyPrefix +
|
|
84
|
-
crypto
|
|
85
|
-
.createHash(accessRuleContentHashAlgorithm)
|
|
86
|
-
.update(JSON.stringify(rule, (key, value) => "bigint" === typeof value ? value.toString() : value))
|
|
87
|
-
.digest("hex");
|
|
88
|
-
export const getRedisAccessRuleValue = (rule) => Object.fromEntries(Object.entries(rule).map(([key, value]) => [key, String(value)]));
|
|
89
|
-
//# sourceMappingURL=redisAccessRulesIndex.js.map
|
package/dist/redis/redisIndex.js
CHANGED
|
@@ -1,23 +1,22 @@
|
|
|
1
1
|
import crypto from "node:crypto";
|
|
2
2
|
const redisIndexHashesRecordKey = "_index_hashes";
|
|
3
3
|
const redisIndexHashAlgorithm = "sha256";
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
}
|
|
12
|
-
await client.ft.dropIndex(index.name);
|
|
4
|
+
const createRedisIndex = async (client, index) => {
|
|
5
|
+
const indexHash = createIndexHash(index);
|
|
6
|
+
const existingIndexes = await client.ft._LIST();
|
|
7
|
+
if (existingIndexes.includes(index.name)) {
|
|
8
|
+
const existingIndexHash = await fetchIndexHash(client, index.name);
|
|
9
|
+
if (indexHash === existingIndexHash) {
|
|
10
|
+
return;
|
|
13
11
|
}
|
|
14
|
-
await client.ft.
|
|
15
|
-
|
|
12
|
+
await client.ft.dropIndex(index.name);
|
|
13
|
+
}
|
|
14
|
+
await client.ft.create(index.name, index.schema, index.options);
|
|
15
|
+
await saveIndexHash(client, index.name, indexHash);
|
|
16
16
|
};
|
|
17
|
-
const createIndexHash = (index) => crypto
|
|
18
|
-
.createHash(redisIndexHashAlgorithm)
|
|
19
|
-
.update(JSON.stringify(index))
|
|
20
|
-
.digest("hex");
|
|
17
|
+
const createIndexHash = (index) => crypto.createHash(redisIndexHashAlgorithm).update(JSON.stringify(index)).digest("hex");
|
|
21
18
|
const fetchIndexHash = async (client, indexName) => client.hGet(redisIndexHashesRecordKey, indexName);
|
|
22
19
|
const saveIndexHash = async (client, indexName, indexHash) => client.hSet(redisIndexHashesRecordKey, indexName, indexHash);
|
|
23
|
-
|
|
20
|
+
export {
|
|
21
|
+
createRedisIndex
|
|
22
|
+
};
|
package/dist/util.js
CHANGED
|
@@ -1,3 +1,5 @@
|
|
|
1
1
|
import crypto from "node:crypto";
|
|
2
|
-
|
|
3
|
-
|
|
2
|
+
const hashUserAgent = (userAgent) => crypto.createHash("sha256").update(userAgent).digest("hex");
|
|
3
|
+
export {
|
|
4
|
+
hashUserAgent
|
|
5
|
+
};
|