@prosopo/user-access-policy 3.4.0 → 3.5.27

package/dist/cjs/redis/redisRulesWriter.cjs

@@ -0,0 +1,100 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const common = require("@prosopo/common");
+const redisClient = require("./redisClient.cjs");
+const redisRuleIndex = require("./redisRuleIndex.cjs");
+class RedisRulesWriter {
+  constructor(client, logger) {
+    this.client = client;
+    this.logger = logger;
+  }
+  async insertRules(ruleEntries) {
+    const entryBatches = common.chunkIntoBatches(ruleEntries, redisClient.REDIS_BATCH_SIZE);
+    const keyBatches = await common.executeBatchesSequentially(
+      entryBatches,
+      async (entriesBatch) => this.insertRuleEntries(entriesBatch)
+    );
+    return keyBatches.flatMap(
+      (ruleKey) => ruleKey.slice(redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX.length)
+    );
+  }
+  async deleteRules(ruleIds) {
+    const ruleKeys = ruleIds.map(
+      (ruleId) => redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX + ruleId
+    );
+    const keyBatches = common.chunkIntoBatches(ruleKeys, redisClient.REDIS_BATCH_SIZE);
+    await common.executeBatchesSequentially(keyBatches, async (keysBatch) => {
+      const queries = this.client.multi();
+      for (const ruleKey of keysBatch) {
+        queries.del(ruleKey);
+      }
+      await queries.exec();
+    });
+  }
+  async deleteAllRules() {
+    let cursor = "0";
+    let total = 0;
+    do {
+      const reply = await this.client.scan(cursor, {
+        MATCH: `${redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX}*`,
+        COUNT: redisClient.REDIS_BATCH_SIZE
+      });
+      const ids = reply.keys.map(
+        (key) => key.slice(redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX.length)
+      );
+      await this.deleteRules(ids);
+      total += ids.length;
+      cursor = reply.cursor;
+    } while ("0" !== cursor);
+    return total;
+  }
+  async insertRuleEntries(ruleEntries) {
+    const queries = this.client.multi();
+    const ruleKeys = ruleEntries.map((ruleEntry) => {
+      const { rule, expiresUnixTimestamp } = ruleEntry;
+      const ruleKey = redisRuleIndex.getAccessRuleRedisKey(rule);
+      const ruleValue = getRedisRuleValue(rule);
+      queries.hSet(ruleKey, ruleValue);
+      if (expiresUnixTimestamp) {
+        queries.expireAt(ruleKey, expiresUnixTimestamp);
+      }
+      return ruleKey;
+    });
+    await queries.exec();
+    return ruleKeys;
+  }
+}
+const getRedisRuleValue = (rule) => Object.fromEntries(
+  Object.entries(rule).map(([key, value]) => [key, String(value)])
+);
+class DummyRedisRulesWriter {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  async insertRules(ruleEntries) {
+    this.logger.info(() => ({
+      msg: "Dummy insertRules() has no effect (redis is not ready)",
+      data: {
+        ruleEntries
+      }
+    }));
+    return [];
+  }
+  async deleteRules(ruleIds) {
+    this.logger.info(() => ({
+      msg: "Dummy deleteRules() has no effect (redis is not ready)",
+      data: {
+        ruleIds
+      }
+    }));
+  }
+  async deleteAllRules() {
+    this.logger.info(() => ({
+      msg: "Dummy deleteAllRules() has no effect (redis is not ready)"
+    }));
+    return 0;
+  }
+}
+exports.DummyRedisRulesWriter = DummyRedisRulesWriter;
+exports.RedisRulesWriter = RedisRulesWriter;
+exports.getRedisRuleValue = getRedisRuleValue;

package/dist/cjs/rule.cjs

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+var AccessPolicyType = /* @__PURE__ */ ((AccessPolicyType2) => {
+  AccessPolicyType2["Block"] = "block";
+  AccessPolicyType2["Restrict"] = "restrict";
+  return AccessPolicyType2;
+})(AccessPolicyType || {});
+exports.AccessPolicyType = AccessPolicyType;

package/dist/cjs/ruleInput/.export.cjs

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ruleInput = require("./ruleInput.cjs");
+const policyInput = require("./policyInput.cjs");
+const userScopeInput = require("./userScopeInput.cjs");
+exports.accessRuleInput = ruleInput.accessRuleInput;
+exports.accessPolicyInput = policyInput.accessPolicyInput;
+exports.policyScopeInput = policyInput.policyScopeInput;
+exports.userScopeInput = userScopeInput.userScopeInput;

package/dist/cjs/ruleInput/policyInput.cjs

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const types = require("@prosopo/types");
+const zod = require("zod");
+const rule = require("../rule.cjs");
+const accessPolicyInput = zod.z.object({
+  type: zod.z.nativeEnum(rule.AccessPolicyType),
+  captchaType: types.CaptchaTypeSchema.optional(),
+  description: zod.z.coerce.string().optional(),
+  // Redis stores values as strings, so coerce is needed to parse properly
+  solvedImagesCount: zod.z.coerce.number().optional(),
+  // the percentage of image panels that must be solved per image CAPTCHA
+  imageThreshold: zod.z.coerce.number().optional(),
+  // the Proof-of-Work difficulty level
+  powDifficulty: zod.z.coerce.number().optional(),
+  // the number of unsolved image CAPTCHA challenges to serve
+  unsolvedImagesCount: zod.z.coerce.number().optional(),
+  // used to increase the user's score
+  frictionlessScore: zod.z.coerce.number().optional()
+});
+const policyScopeInput = zod.z.object({
+  clientId: zod.z.coerce.string().optional()
+});
+exports.accessPolicyInput = accessPolicyInput;
+exports.policyScopeInput = policyScopeInput;

package/dist/cjs/ruleInput/ruleInput.cjs

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const zod = require("zod");
+const rulesStorage = require("../rulesStorage.cjs");
+const policyInput = require("./policyInput.cjs");
+const userScopeInput = require("./userScopeInput.cjs");
+const ruleGroupInput = zod.z.object({
+  groupId: zod.z.coerce.string().optional(),
+  ruleGroupId: zod.z.coerce.string().optional()
+}).transform((ruleGroupInput2) => {
+  const { ruleGroupId, ...ruleGroup } = ruleGroupInput2;
+  if ("string" === typeof ruleGroupId) {
+    ruleGroup.groupId = ruleGroupId;
+  }
+  return ruleGroup;
+});
+const accessRuleInput = zod.z.object({
+  ...policyInput.accessPolicyInput.shape,
+  ...policyInput.policyScopeInput.shape
+}).and(userScopeInput.userScopeInput).and(ruleGroupInput).transform((ruleInput) => ruleInput);
+const ruleEntryInput = zod.z.object({
+  rule: accessRuleInput,
+  expiresUnixTimestamp: zod.z.coerce.number().optional()
+});
+const accessRulesFilterInput = zod.z.object({
+  policyScope: policyInput.policyScopeInput.optional(),
+  policyScopes: zod.z.array(policyInput.policyScopeInput).optional(),
+  policyScopeMatch: zod.z.nativeEnum(rulesStorage.FilterScopeMatch).default(rulesStorage.FilterScopeMatch.Exact),
+  userScope: userScopeInput.userScopeInput.optional(),
+  userScopeMatch: zod.z.nativeEnum(rulesStorage.FilterScopeMatch).default(rulesStorage.FilterScopeMatch.Exact),
+  groupId: zod.z.string().optional()
+});
+const getAccessRuleFiltersFromInput = (filterInput) => {
+  const { policyScopes, policyScope, ...filterBase } = filterInput;
+  const allPolicyScopes = policyScopes || [];
+  if (policyScope) {
+    allPolicyScopes.push(policyScope);
+  }
+  if (allPolicyScopes.length > 0) {
+    return allPolicyScopes.map((policyScope2) => ({
+      ...filterBase,
+      policyScope: policyScope2
+    }));
+  }
+  return [filterBase];
+};
+exports.accessRuleInput = accessRuleInput;
+exports.accessRulesFilterInput = accessRulesFilterInput;
+exports.getAccessRuleFiltersFromInput = getAccessRuleFiltersFromInput;
+exports.ruleEntryInput = ruleEntryInput;

package/dist/cjs/ruleInput/userScopeInput.cjs

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const crypto = require("node:crypto");
+const util = require("@prosopo/util");
+const ipAddress = require("ip-address");
+const zod = require("zod");
+const userAttributesSchema = zod.z.object({
+  // coerce is used for safety, as e.g., incoming userId can be digital
+  userId: zod.z.coerce.string().optional(),
+  ja4Hash: zod.z.coerce.string().optional(),
+  headersHash: zod.z.coerce.string().optional(),
+  userAgentHash: zod.z.coerce.string().optional()
+});
+const userAttributesInput = zod.z.object({
+  ...userAttributesSchema.shape,
+  userAgent: zod.z.coerce.string().optional()
+}).transform((userAttributesInput2) => {
+  const { userAgent, ...userScope } = userAttributesInput2;
+  if ("string" === typeof userAgent) {
+    userScope.userAgentHash = hashUserAgent(userAgent);
+  }
+  return userScope;
+});
+const hashUserAgent = (userAgent) => crypto.createHash("sha256").update(userAgent).digest("hex");
+const userIpSchema = zod.z.object({
+  numericIp: zod.z.coerce.bigint().optional(),
+  numericIpMaskMin: zod.z.coerce.bigint().optional(),
+  numericIpMaskMax: zod.z.coerce.bigint().optional()
+});
+const userIpInput = zod.z.object({
+  ...userIpSchema.shape,
+  ip: zod.z.string().optional(),
+  ipMask: zod.z.string().optional()
+}).transform((userIpInput2) => {
+  const { ip, ipMask, ...numericUserIp } = userIpInput2;
+  if ("string" === typeof ip) {
+    numericUserIp.numericIp = util.getIPAddress(ip).bigInt();
+  }
+  if ("string" === typeof ipMask) {
+    const ipObject = new ipAddress.Address4(ipMask);
+    numericUserIp.numericIpMaskMin = ipObject.startAddress().bigInt();
+    numericUserIp.numericIpMaskMax = ipObject.endAddress().bigInt();
+  }
+  return numericUserIp;
+});
+const userScopeSchema = zod.z.object({
+  ...userIpSchema.shape,
+  ...userAttributesSchema.shape
+});
+const userScopeInput = zod.z.object({}).and(userIpInput).and(userAttributesInput).transform(
+  // transform is used for type safety only - plain "satisfies ZodType<x>" doesn't work after ".and()"
+  (userScopeInput2) => userScopeInput2
+);
+exports.userScopeInput = userScopeInput;
+exports.userScopeSchema = userScopeSchema;

package/dist/cjs/ruleRecord.cjs

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const userAttributesRecordFields = [
+  "userId",
+  "ja4Hash",
+  "headersHash",
+  "userAgent"
+];
+const userIpRecordFields = [
+  "ip",
+  "ipMask"
+];
+const userScopeRecordFields = [
+  ...userAttributesRecordFields,
+  ...userIpRecordFields
+];
+const getUserScopeRecordFromAccessRuleRecord = (ruleRecord) => Object.fromEntries(
+  userScopeRecordFields.map((field) => [field, ruleRecord[field]]).filter(([, value]) => value !== void 0)
+);
+exports.getUserScopeRecordFromAccessRuleRecord = getUserScopeRecordFromAccessRuleRecord;
+exports.userAttributesRecordFields = userAttributesRecordFields;
+exports.userIpRecordFields = userIpRecordFields;
+exports.userScopeRecordFields = userScopeRecordFields;

package/dist/cjs/rulesStorage.cjs

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+var FilterScopeMatch = /* @__PURE__ */ ((FilterScopeMatch2) => {
+  FilterScopeMatch2["Exact"] = "exact";
+  FilterScopeMatch2["Greedy"] = "greedy";
+  return FilterScopeMatch2;
+})(FilterScopeMatch || {});
+exports.FilterScopeMatch = FilterScopeMatch;

package/dist/cjs/transformRule.cjs

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const crypto = require("node:crypto");
+const cidrCalc = require("cidr-calc");
+const ipAddress = require("ip-address");
+const zod = require("zod");
+const policyInput = require("./ruleInput/policyInput.cjs");
+const ruleInput = require("./ruleInput/ruleInput.cjs");
+const userScopeInput = require("./ruleInput/userScopeInput.cjs");
+const RULE_HASH_ALGORITHM = "md5";
+const makeAccessRuleHash = (rule) => {
+  const valueProperties = Object.entries(rule).filter(
+    ([key, value]) => "undefined" !== typeof value
+  );
+  const orderedProperties = valueProperties.sort();
+  const objectToHash = Object.fromEntries(orderedProperties);
+  return hashObject(objectToHash, RULE_HASH_ALGORITHM);
+};
+const transformAccessRuleRecordIntoRule = (ruleRecord) => (
+  // accessRuleInput does all the record field transformations
+  ruleInput.accessRuleInput.parse(ruleRecord)
+);
+const transformAccessRuleIntoRecord = (rule) => accessRuleToRecordScheme.parse(rule);
+const accessRuleToRecordScheme = zod.z.object({
+  ...policyInput.accessPolicyInput.shape,
+  ...policyInput.policyScopeInput.shape,
+  ...userScopeInput.userScopeSchema.shape,
+  groupId: zod.z.coerce.string().optional()
+}).transform((ruleInput2) => {
+  const {
+    groupId,
+    numericIp,
+    numericIpMaskMin,
+    numericIpMaskMax,
+    userAgentHash,
+    ...rule
+  } = ruleInput2;
+  const record = rule;
+  if ("string" === typeof groupId) {
+    record.ruleGroupId = groupId;
+  }
+  if ("string" === typeof userAgentHash) {
+    record.userAgent = userAgentHash;
+  }
+  if ("bigint" === typeof numericIp) {
+    record.ip = getStringIpFromNumeric(numericIp);
+  }
+  if ("bigint" === typeof numericIpMaskMin && "bigint" === typeof numericIpMaskMax) {
+    record.ipMask = getCidrFromNumericIpRange(
+      numericIpMaskMin,
+      numericIpMaskMax
+    );
+  }
+  return record;
+});
+const hashObject = (object, algorithm) => crypto.createHash(algorithm).update(
+  JSON.stringify(
+    object,
+    (key, value) => (
+      // JSON.stringify can't handle BigInt itself: throws "Do not know how to serialize a BigInt"
+      "bigint" === typeof value ? value.toString() : value
+    )
+  )
+).digest("hex");
+const getStringIpFromNumeric = (numericIp) => ipAddress.Address4.fromInteger(Number(numericIp)).address;
+const getCidrFromNumericIpRange = (startIp, endIp) => {
+  const ipRange = new cidrCalc.IpRange(
+    cidrCalc.IpAddress.of(getStringIpFromNumeric(startIp)),
+    cidrCalc.IpAddress.of(getStringIpFromNumeric(endIp))
+  );
+  const cidr = ipRange.toCidrs()[0];
+  return cidr ? `${cidr.prefix.toString()}/${cidr.prefixLen}` : void 0;
+};
+exports.getCidrFromNumericIpRange = getCidrFromNumericIpRange;
+exports.makeAccessRuleHash = makeAccessRuleHash;
+exports.transformAccessRuleIntoRecord = transformAccessRuleIntoRecord;
+exports.transformAccessRuleRecordIntoRule = transformAccessRuleRecordIntoRule;

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export { type AccessPolicy, AccessPolicyType, type AccessRuleExtended, type PolicyScope, type UserScope, type UserScopeApiInput, type UserScopeApiOutput, accessPolicySchema, accessRuleSchemaExtended, policyScopeSchema, } from "#policy/accessPolicy.js";
+export { type PolicyFilter, ScopeMatch } from "#policy/accessPolicyResolver.js";
+export { type AccessRule, type AccessRulesStorage, accessRuleSchema, } from "#policy/accessRules.js";
+export { accessRuleApiPaths, getExpressApiRuleRateLimits, } from "#policy/api/accessRuleApiRoutes.js";
+export { type DeleteAllRulesEndpointSchema, deleteAllRulesEndpointSchema, } from "#policy/api/deleteAllRulesEndpoint.js";
+export { type DeleteRulesEndpointSchemaInput, type DeleteRulesEndpointSchemaOutput, deleteRulesEndpointSchema, } from "#policy/api/deleteRulesEndpoint.js";
+export { type InsertManyRulesEndpointInputSchema, type InsertManyRulesEndpointOutputSchema, insertRulesEndpointSchema, } from "#policy/api/insertRulesEndpoint.js";
+export { createRedisAccessRulesStorage } from "#policy/redis/redisRulesStorage.js";
+export { userScopeInputSchema } from "./accessPolicy.js";
+export { redisAccessRulesIndex } from "./redis/redisRulesIndex.js";
+export { AccessRulesApiClient } from "./api/accessRulesApiClient.js";
+import type { ApiRoutesProvider } from "@prosopo/api-route";
+import type { AccessRulesStorage } from "#policy/accessRules.js";
+export declare const createApiRuleRoutesProvider: (rulesStorage: AccessRulesStorage) => ApiRoutesProvider;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,EACN,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,KAAK,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EACN,KAAK,UAAU,EACf,KAAK,kBAAkB,EACvB,gBAAgB,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,kBAAkB,EAClB,2BAA2B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,KAAK,4BAA4B,EACjC,4BAA4B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACN,KAAK,8BAA8B,EACnC,KAAK,+BAA+B,EACpC,yBAAyB,GACzB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACN,KAAK,kCAAkC,EACvC,KAAK,mCAAmC,EACxC,yBAAyB,GACzB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAGjE,eAAO,MAAM,2BAA2B,iBACzB,kBAAkB,KAC9B,iBAEF,CAAC"}

package/dist/index.js

@@ -1,28 +1,32 @@
 import { AccessPolicyType, accessPolicySchema, accessRuleSchemaExtended, policyScopeSchema, userScopeInputSchema } from "./accessPolicy.js";
 import { ScopeMatch } from "./accessPolicyResolver.js";
+import { accessRuleSchema } from "./accessRules.js";
 import { AccessRuleApiRoutes } from "./api/accessRuleApiRoutes.js";
 import { accessRuleApiPaths, getExpressApiRuleRateLimits } from "./api/accessRuleApiRoutes.js";
 import { deleteAllRulesEndpointSchema } from "./api/deleteAllRulesEndpoint.js";
 import { deleteRulesEndpointSchema } from "./api/deleteRulesEndpoint.js";
 import { insertRulesEndpointSchema } from "./api/insertRulesEndpoint.js";
-import { createRedisAccessRulesStorage } from "./redis/redisAccessRules.js";
-import { createRedisAccessRulesIndex } from "./redis/redisAccessRulesIndex.js";
+import { createRedisAccessRulesStorage } from "./redis/redisRulesStorage.js";
+import { redisAccessRulesIndex } from "./redis/redisRulesIndex.js";
+import { AccessRulesApiClient } from "./api/accessRulesApiClient.js";
 const createApiRuleRoutesProvider = (rulesStorage) => {
   return new AccessRuleApiRoutes(rulesStorage);
 };
 export {
   AccessPolicyType,
+  AccessRulesApiClient,
   ScopeMatch,
   accessPolicySchema,
   accessRuleApiPaths,
+  accessRuleSchema,
   accessRuleSchemaExtended,
   createApiRuleRoutesProvider,
-  createRedisAccessRulesIndex,
   createRedisAccessRulesStorage,
   deleteAllRulesEndpointSchema,
   deleteRulesEndpointSchema,
   getExpressApiRuleRateLimits,
   insertRulesEndpointSchema,
   policyScopeSchema,
+  redisAccessRulesIndex,
   userScopeInputSchema
 };

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAcA,OAAO,EAEN,gBAAgB,EAMhB,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAqB,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAChF,OAAO,EAGN,gBAAgB,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,kBAAkB,EAClB,2BAA2B,GAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEN,4BAA4B,GAC5B,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAGN,yBAAyB,GACzB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAGN,yBAAyB,GACzB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAIrE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAC1C,YAAgC,EACZ,EAAE;IACtB,OAAO,IAAI,mBAAmB,CAAC,YAAY,CAAC,CAAC;AAC9C,CAAC,CAAC"}

package/dist/mongoose/.export.d.ts

@@ -0,0 +1,2 @@
+export { accessRuleMongooseSchema } from "./mongooseRuleSchema.js";
+//# sourceMappingURL=.export.d.ts.map

package/dist/mongoose/.export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":".export.d.ts","sourceRoot":"","sources":["../../src/mongoose/.export.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/mongoose/.export.js

@@ -0,0 +1,4 @@
+import { accessRuleMongooseSchema } from "./mongooseRuleSchema.js";
+export {
+  accessRuleMongooseSchema
+};

package/dist/mongoose/.export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":".export.js","sourceRoot":"","sources":["../../src/mongoose/.export.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/mongoose/mongooseRuleSchema.d.ts

@@ -0,0 +1,4 @@
+import type { SchemaDefinition } from "mongoose";
+import type { AccessRuleRecord } from "#policy/ruleRecord.js";
+export declare const accessRuleMongooseSchema: SchemaDefinition<AccessRuleRecord>;
+//# sourceMappingURL=mongooseRuleSchema.d.ts.map

package/dist/mongoose/mongooseRuleSchema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongooseRuleSchema.d.ts","sourceRoot":"","sources":["../../src/mongoose/mongooseRuleSchema.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,KAAK,EACX,gBAAgB,EAIhB,MAAM,uBAAuB,CAAC;AAkC/B,eAAO,MAAM,wBAAwB,EAAE,gBAAgB,CAAC,gBAAgB,CAKtC,CAAC"}

package/dist/mongoose/mongooseRuleSchema.js

@@ -0,0 +1,36 @@
+const userAttributesSchema = {
+  userId: { type: String, required: false },
+  ja4Hash: { type: String, required: false },
+  userAgent: { type: String, required: false },
+  headersHash: { type: String, required: false }
+};
+const userIpSchema = {
+  ip: { type: String, required: false },
+  ipMask: { type: String, required: false }
+};
+const userScopeSchema = {
+  ...userAttributesSchema,
+  ...userIpSchema
+};
+const policyScopeSchema = {
+  clientId: { type: String, required: false }
+};
+const accessPolicySchema = {
+  type: { type: String, required: true },
+  captchaType: { type: String, required: false },
+  description: { type: String, required: false },
+  solvedImagesCount: { type: Number, required: false },
+  imageThreshold: { type: Number, required: false },
+  powDifficulty: { type: Number, required: false },
+  unsolvedImagesCount: { type: Number, required: false },
+  frictionlessScore: { type: Number, required: false }
+};
+const accessRuleMongooseSchema = {
+  ...accessPolicySchema,
+  ...policyScopeSchema,
+  ...userScopeSchema,
+  ruleGroupId: { type: String, required: false }
+};
+export {
+  accessRuleMongooseSchema
+};

package/dist/mongoose/mongooseRuleSchema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongooseRuleSchema.js","sourceRoot":"","sources":["../../src/mongoose/mongooseRuleSchema.ts"],"names":[],"mappings":"AAwBA,MAAM,oBAAoB,GAA2C;IACpE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;IACzC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC1C,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC5C,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;CACN,CAAC;AAE1C,MAAM,YAAY,GAAmC;IACpD,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;IACrC,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;CACT,CAAC;AAElC,MAAM,eAAe,GAAsC;IAC1D,GAAG,oBAAoB;IACvB,GAAG,YAAY;CACiB,CAAC;AAElC,MAAM,iBAAiB,GAAkC;IACxD,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;CACZ,CAAC;AAEjC,MAAM,kBAAkB,GAAmC;IAC1D,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;IACtC,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC9C,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;IAC9C,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;IACpD,cAAc,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;IACjD,aAAa,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;IAChD,mBAAmB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;IACtD,iBAAiB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;CACpB,CAAC;AAElC,MAAM,CAAC,MAAM,wBAAwB,GAAuC;IAC3E,GAAG,kBAAkB;IACrB,GAAG,iBAAiB;IACpB,GAAG,eAAe;IAClB,WAAW,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE;CACb,CAAC"}

package/dist/redis/.export.d.ts

@@ -0,0 +1,3 @@
+export { createRedisAccessRulesStorage } from "./redisRulesStorage.js";
+export { accessRulesRedisIndex } from "./redisRuleIndex.js";
+//# sourceMappingURL=.export.d.ts.map

package/dist/redis/.export.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":".export.d.ts","sourceRoot":"","sources":["../../src/redis/.export.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/redis/.export.js

@@ -0,0 +1,6 @@
+import { createRedisAccessRulesStorage } from "./redisRulesStorage.js";
+import { accessRulesRedisIndex } from "./redisRuleIndex.js";
+export {
+  accessRulesRedisIndex,
+  createRedisAccessRulesStorage
+};

package/dist/redis/.export.js.map

@@ -0,0 +1 @@
+{"version":3,"file":".export.js","sourceRoot":"","sources":["../../src/redis/.export.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC;AAEvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/redis/reader/redisAggregate.d.ts

@@ -0,0 +1,4 @@
+import type { Logger } from "@prosopo/common";
+import type { RedisClientType } from "redis";
+export declare const aggregateRedisKeys: (client: RedisClientType, query: string, logger: Logger, batchHandler?: (keys: string[]) => Promise<void>) => Promise<string[]>;
+//# sourceMappingURL=redisAggregate.d.ts.map

package/dist/redis/reader/redisAggregate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisAggregate.d.ts","sourceRoot":"","sources":["../../../src/redis/reader/redisAggregate.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAU7C,eAAO,MAAM,kBAAkB,WACtB,eAAe,SAChB,MAAM,UACL,MAAM,iBACC,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,KAC9C,OAAO,CAAC,MAAM,EAAE,CA0ClB,CAAC"}

package/dist/redis/reader/redisAggregate.js

@@ -0,0 +1,60 @@
+import { z } from "zod";
+import { REDIS_QUERY_DIALECT } from "./redisRulesQuery.js";
+import { parseRedisRecords, REDIS_BATCH_SIZE } from "../redisClient.js";
+import { ACCESS_RULES_REDIS_INDEX_NAME } from "../redisRuleIndex.js";
+const aggregateRedisKeys = async (client, query, logger, batchHandler) => {
+  const keyField = "__key";
+  const recordSchema = z.object({
+    // it's a reserved name for the record key
+    [keyField]: z.string()
+  });
+  const foundKeys = [];
+  const addRecordKeys = async (records) => {
+    const parsedRecords = parseRedisRecords(records, recordSchema, logger);
+    const recordKeys = parsedRecords.map((record) => record[keyField]);
+    if (batchHandler) {
+      await batchHandler(recordKeys);
+    } else {
+      foundKeys.push(...recordKeys);
+      logger.debug(() => ({
+        msg: "Processed aggregation batch",
+        data: {
+          size: recordKeys.length
+        }
+      }));
+    }
+  };
+  await executeAggregation(
+    client,
+    query,
+    {
+      // #2 is a required option when the 'ismissing()' function is in the query body
+      DIALECT: REDIS_QUERY_DIALECT,
+      COUNT: REDIS_BATCH_SIZE,
+      LOAD: `@${keyField}`
+    },
+    addRecordKeys
+  );
+  return foundKeys;
+};
+const executeAggregation = async (client, query, aggregateOptions, handleBatch) => {
+  const initialReply = await client.ft.aggregateWithCursor(
+    ACCESS_RULES_REDIS_INDEX_NAME,
+    query,
+    aggregateOptions
+  );
+  await handleBatch(initialReply.results);
+  let cursor = initialReply.cursor;
+  while (0 !== cursor) {
+    const batchReply = await client.ft.cursorRead(
+      ACCESS_RULES_REDIS_INDEX_NAME,
+      cursor,
+      { COUNT: aggregateOptions.COUNT }
+    );
+    await handleBatch(batchReply.results);
+    cursor = batchReply.cursor;
+  }
+};
+export {
+  aggregateRedisKeys
+};

package/dist/redis/reader/redisAggregate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisAggregate.js","sourceRoot":"","sources":["../../../src/redis/reader/redisAggregate.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EACN,gBAAgB,EAChB,iBAAiB,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACtC,MAAuB,EACvB,KAAa,EACb,MAAc,EACd,YAAgD,EAC5B,EAAE;IACtB,MAAM,QAAQ,GAAG,OAAO,CAAC;IAEzB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;QAE7B,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,MAAM,aAAa,GAAG,KAAK,EAAE,OAAiB,EAAE,EAAE;QACjD,MAAM,aAAa,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QAEvE,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnE,IAAI,YAAY,EAAE,CAAC;YAClB,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;YAE9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnB,GAAG,EAAE,6BAA6B;gBAClC,IAAI,EAAE;oBACL,IAAI,EAAE,UAAU,CAAC,MAAM;iBACvB;aACD,CAAC,CAAC,CAAC;QACL,CAAC;IACF,CAAC,CAAC;IAEF,MAAM,kBAAkB,CACvB,MAAM,EACN,KAAK,EACL;QAEC,OAAO,EAAE,mBAAmB;QAC5B,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,IAAI,QAAQ,EAAE;KACpB,EACD,aAAa,CACb,CAAC;IAEF,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAC/B,MAAuB,EACvB,KAAa,EACb,gBAA8C,EAC9C,WAAiD,EACjC,EAAE;IAClB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,mBAAmB,CACvD,6BAA6B,EAC7B,KAAK,EACL,gBAAgB,CAChB,CAAC;IAEF,MAAM,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAEjC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,UAAU,CAC5C,6BAA6B,EAC7B,MAAM,EACN,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,CACjC,CAAC;QAEF,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAC5B,CAAC;AACF,CAAC,CAAC"}

package/dist/redis/reader/redisRulesQuery.d.ts

@@ -0,0 +1,4 @@
+import { type AccessRulesFilter } from "#policy/rulesStorage.js";
+export declare const REDIS_QUERY_DIALECT = 2;
+export declare const getRulesRedisQuery: (filter: AccessRulesFilter, matchingFieldsOnly: boolean) => string;
+//# sourceMappingURL=redisRulesQuery.d.ts.map

package/dist/redis/reader/redisRulesQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesQuery.d.ts","sourceRoot":"","sources":["../../../src/redis/reader/redisRulesQuery.ts"],"names":[],"mappings":"AAgBA,OAAO,EACN,KAAK,iBAAiB,EAEtB,MAAM,yBAAyB,CAAC;AAKjC,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAmIrC,eAAO,MAAM,kBAAkB,WACtB,iBAAiB,sBACL,OAAO,KACzB,MA4BF,CAAC"}