@prosopo/user-access-policy 3.4.0 → 3.5.27

package/dist/redis/redisAccessRulesIndex.js

@@ -1,130 +1,140 @@
 import crypto from "node:crypto";
 import { SCHEMA_FIELD_TYPE } from "@redis/search";
-import { ScopeMatch } from "../accessPolicyResolver.js";
-import { createRedisIndex } from "./redisIndex.js";
-const accessRulesRedisIndexName = "index:user-access-rules";
-const accessRuleRedisKeyPrefix = "uar:";
+import { userScopeSchema, } from "#policy/accessPolicy.js";
+import { ScopeMatch } from "#policy/accessPolicyResolver.js";
+import { createRedisIndex } from "#policy/redis/redisIndex.js";
+export const accessRulesRedisIndexName = "index:user-access-rules";
+export const accessRuleRedisKeyPrefix = "uar:";
 const accessRuleContentHashAlgorithm = "md5";
-const DEFAULT_SEARCH_LIMIT = 1e3;
+const DEFAULT_SEARCH_LIMIT = 1000;
 const accessRulesIndex = {
-  name: accessRulesRedisIndexName,
-  /**
-   * Note on the field type decision
-   *
-   * TAG is designed for the exact value matching
-   * TEXT is designed for the word-based and pattern matching
-   *
-   * For our goal TAG fits perfectly and, more performant
-   */
-  schema: {
-    clientId: {
-      type: SCHEMA_FIELD_TYPE.TAG,
-      // necessary to make possible use of the ismissing() function on this field in the search
-      INDEXMISSING: true
+    name: accessRulesRedisIndexName,
+    schema: {
+        clientId: {
+            type: SCHEMA_FIELD_TYPE.TAG,
+            INDEXMISSING: true,
+        },
+        numericIpMaskMin: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+        numericIpMaskMax: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+        userId: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+        numericIp: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+        ja4Hash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+        headersHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+        userAgentHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    },
+    options: {
+        ON: "HASH",
+        PREFIX: [accessRuleRedisKeyPrefix],
     },
-    numericIpMaskMin: SCHEMA_FIELD_TYPE.NUMERIC,
-    numericIpMaskMax: SCHEMA_FIELD_TYPE.NUMERIC,
-    userId: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
-    numericIp: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
-    ja4Hash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
-    headersHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
-    userAgentHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true }
-  },
-  // the satisfy statement is to guarantee that the keys are right
-  options: {
-    ON: "HASH",
-    PREFIX: [accessRuleRedisKeyPrefix]
-  }
 };
-const createRedisAccessRulesIndex = async (client, indexName) => {
-  if (indexName) {
-    accessRulesIndex.name = indexName;
-  }
-  return createRedisIndex(client, accessRulesIndex);
+export const createRedisAccessRulesIndex = async (client, indexName) => {
+    if (indexName) {
+        accessRulesIndex.name = indexName;
+    }
+    return createRedisIndex(client, accessRulesIndex);
 };
 const numericIndexFields = [
-  "numericIp",
-  "numericIpMaskMin",
-  "numericIpMaskMax"
+    "numericIp",
+    "numericIpMaskMin",
+    "numericIpMaskMax",
 ];
 const greedyFieldComparisons = {
-  numericIp: (value) => `( @numericIp:[${value}] | ( @numericIpMaskMin:[-inf ${value}] @numericIpMaskMax:[${value} +inf] ) )`
+    numericIp: (value, scope) => {
+        if (value !== undefined) {
+            return `( @numericIp:[${value}] | ( @numericIpMaskMin:[-inf ${value}] @numericIpMaskMax:[${value} +inf] ) )`;
+        }
+        if (scope.numericIpMaskMin === undefined &&
+            scope.numericIpMaskMax === undefined) {
+            return "ismissing(@numericIp) ismissing(@numericIpMaskMin) ismissing(@numericIpMaskMax)";
+        }
+        return "";
+    },
+    numericIpMaskMin: (value, scope) => {
+        if (scope.numericIp !== undefined) {
+            return "";
+        }
+        return value !== undefined
+            ? `@numericIpMaskMin:[-inf ${value}]`
+            : "ismissing(@numericIpMaskMin)";
+    },
+    numericIpMaskMax: (value, scope) => {
+        if (scope.numericIp !== undefined) {
+            return "";
+        }
+        return value !== undefined
+            ? `@numericIpMaskMax:[${value} +inf]`
+            : "ismissing(@numericIpMaskMax)";
+    },
 };
-const accessRulesRedisSearchOptions = {
-  // #2 is a required option when the 'ismissing()' function is in the query body
-  DIALECT: 2
+export const accessRulesRedisSearchOptions = {
+    DIALECT: 2,
 };
-const accessRulesRedisDeleteOptions = {
-  // #2 is a required option when the 'ismissing()' function is in the query body
-  DIALECT: 2,
-  LIMIT: {
-    from: 0,
-    size: DEFAULT_SEARCH_LIMIT
-  }
+export const accessRulesRedisDeleteOptions = {
+    DIALECT: 2,
+    LIMIT: {
+        from: 0,
+        size: DEFAULT_SEARCH_LIMIT,
+    },
 };
-const getRedisAccessRulesQuery = (filter) => {
-  const { policyScope, userScope } = filter;
-  const policyScopeFilter = getPolicyScopeQuery(
-    policyScope,
-    filter.policyScopeMatch
-  );
-  if (userScope && Object.keys(userScope).length > 0) {
-    const userScopeFilter = getUserScopeQuery(userScope, filter.userScopeMatch);
-    return `${policyScopeFilter} ( ${userScopeFilter} )`;
-  }
-  return policyScopeFilter ? policyScopeFilter : "*";
+export const getRedisAccessRulesQuery = (filter, matchingFieldsOnly) => {
+    const { policyScope, userScope } = filter;
+    const policyScopeFilter = getPolicyScopeQuery(policyScope, filter.policyScopeMatch);
+    if (userScope && Object.keys(userScope).length > 0) {
+        const userScopeFilter = getUserScopeQuery(userScope, filter.userScopeMatch, matchingFieldsOnly);
+        return `${policyScopeFilter} ( ${userScopeFilter} )`;
+    }
+    return policyScopeFilter ? policyScopeFilter : "*";
 };
 const getPolicyScopeQuery = (policyScope, scopeMatchType) => {
-  const clientId = policyScope?.clientId;
-  if ("string" === typeof clientId) {
-    return ScopeMatch.Exact === scopeMatchType ? `@clientId:{${clientId}}` : `( @clientId:{${clientId}} | ismissing(@clientId) )`;
-  }
-  return ScopeMatch.Exact === scopeMatchType ? "ismissing(@clientId)" : "";
-};
-const getUserScopeQuery = (userScope, scopeMatchType) => {
-  let scopeEntries = Object.entries(userScope);
-  let scopeJoinType = " ";
-  if (scopeMatchType === ScopeMatch.Greedy) {
-    scopeEntries = scopeEntries.filter(
-      ([_, value]) => value !== void 0
-    );
-    scopeJoinType = " | ";
-  }
-  return scopeEntries.map(
-    ([scopeFieldName, scopeFieldValue]) => getUserScopeFieldQuery(scopeFieldName, scopeFieldValue, scopeMatchType)
-  ).join(scopeJoinType);
+    const clientId = policyScope?.clientId;
+    if ("string" === typeof clientId) {
+        return ScopeMatch.Exact === scopeMatchType
+            ? `@clientId:{${clientId}}`
+            : `( @clientId:{${clientId}} | ismissing(@clientId) )`;
+    }
+    return ScopeMatch.Exact === scopeMatchType ? "ismissing(@clientId)" : "";
 };
-const getUserScopeFieldQuery = (fieldName, fieldValue, matchType) => {
-  if (
-    //ScopeMatch.Greedy === matchType &&
-    "function" === typeof greedyFieldComparisons[fieldName]
-  ) {
-    return greedyFieldComparisons[fieldName](fieldValue);
-  }
-  if (fieldValue === void 0) {
-    return `ismissing(@${fieldName})`;
-  }
-  return numericIndexFields.includes(fieldName) ? `@${fieldName}:[${fieldValue}]` : `@${fieldName}:{${fieldValue}}`;
+const getUserScopeQuery = (userScope, scopeMatchType, matchingFieldsOnly) => {
+    let scopeEntries = Object.entries(userScope);
+    let scopeJoinType = " ";
+    if (scopeMatchType === ScopeMatch.Greedy) {
+        scopeEntries = scopeEntries.filter(([_, value]) => value !== undefined);
+        scopeJoinType = " | ";
+    }
+    if (matchingFieldsOnly) {
+        const scopeMap = new Map(scopeEntries);
+        if (scopeMap.has("numericIp") && scopeMap.get("numericIp") === undefined) {
+            scopeMap.set("numericIpMaskMin", undefined);
+            scopeMap.set("numericIpMaskMax", undefined);
+        }
+        for (const name of Object.keys(userScopeSchema.shape)) {
+            if (!scopeMap.has(name)) {
+                scopeMap.set(name, undefined);
+            }
+        }
+        scopeEntries = [...scopeMap.entries()];
+    }
+    const scopeObj = Object.fromEntries(scopeEntries);
+    return scopeEntries
+        .map(([scopeFieldName, scopeFieldValue]) => getUserScopeFieldQuery(scopeFieldName, scopeFieldValue, scopeMatchType, scopeObj))
+        .filter(Boolean)
+        .join(scopeJoinType);
 };
-const getRedisAccessRuleKey = (rule) => accessRuleRedisKeyPrefix + crypto.createHash(accessRuleContentHashAlgorithm).update(
-  JSON.stringify(
-    rule,
-    (key, value) => (
-      // JSON.stringify can't handle BigInt itself: throws "Do not know how to serialize a BigInt"
-      "bigint" === typeof value ? value.toString() : value
-    )
-  )
-).digest("hex");
-const getRedisAccessRuleValue = (rule) => Object.fromEntries(
-  Object.entries(rule).map(([key, value]) => [key, String(value)])
-);
-export {
-  accessRuleRedisKeyPrefix,
-  accessRulesRedisDeleteOptions,
-  accessRulesRedisIndexName,
-  accessRulesRedisSearchOptions,
-  createRedisAccessRulesIndex,
-  getRedisAccessRuleKey,
-  getRedisAccessRuleValue,
-  getRedisAccessRulesQuery
+const getUserScopeFieldQuery = (fieldName, fieldValue, matchType, fullScope) => {
+    if ("function" === typeof greedyFieldComparisons[fieldName]) {
+        return greedyFieldComparisons[fieldName](fieldValue, fullScope);
+    }
+    if (fieldValue === undefined) {
+        return `ismissing(@${fieldName})`;
+    }
+    return numericIndexFields.includes(fieldName)
+        ? `@${fieldName}:[${fieldValue}]`
+        : `@${fieldName}:{${fieldValue}}`;
 };
+export const getRedisAccessRuleKey = (rule) => accessRuleRedisKeyPrefix +
+    crypto
+        .createHash(accessRuleContentHashAlgorithm)
+        .update(JSON.stringify(rule, (key, value) => "bigint" === typeof value ? value.toString() : value))
+        .digest("hex");
+export const getRedisAccessRuleValue = (rule) => Object.fromEntries(Object.entries(rule).map(([key, value]) => [key, String(value)]));
+//# sourceMappingURL=redisAccessRulesIndex.js.map

package/dist/redis/redisAccessRulesIndex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisAccessRulesIndex.js","sourceRoot":"","sources":["../../src/redis/redisAccessRulesIndex.ts"],"names":[],"mappings":"AAcA,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAwB,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAExE,OAAO,EAGN,eAAe,GACf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAqB,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAAmB,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEhF,MAAM,CAAC,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAEnE,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAC/C,MAAM,8BAA8B,GAAG,KAAK,CAAC;AAC7C,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,MAAM,gBAAgB,GAAe;IACpC,IAAI,EAAE,yBAAyB;IAS/B,MAAM,EAAE;QACP,QAAQ,EAAE;YACT,IAAI,EAAE,iBAAiB,CAAC,GAAG;YAE3B,YAAY,EAAE,IAAI;SAClB;QACD,gBAAgB,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;QACzE,gBAAgB,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;QACzE,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;QAC3D,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;QAClE,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;QAC5D,WAAW,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;QAChE,aAAa,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;KACL;IAE9D,OAAO,EAAE;QACR,EAAE,EAAE,MAAe;QACnB,MAAM,EAAE,CAAC,wBAAwB,CAAC;KAClC;CACD,CAAC;AAEF,MAAM,CAAC,MAAM,2BAA2B,GAAG,KAAK,EAC/C,MAAuB,EACvB,SAAkB,EACF,EAAE;IAClB,IAAI,SAAS,EAAE,CAAC;QACf,gBAAgB,CAAC,IAAI,GAAG,SAAS,CAAC;IACnC,CAAC;IACD,OAAO,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AACnD,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAA4B;IACnD,WAAW;IACX,kBAAkB;IAClB,kBAAkB;CAClB,CAAC;AAOF,MAAM,sBAAsB,GAAoC;IAC/D,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,iBAAiB,KAAK,iCAAiC,KAAK,wBAAwB,KAAK,YAAY,CAAC;QAC9G,CAAC;QAED,IACC,KAAK,CAAC,gBAAgB,KAAK,SAAS;YACpC,KAAK,CAAC,gBAAgB,KAAK,SAAS,EACnC,CAAC;YACF,OAAO,iFAAiF,CAAC;QAC1F,CAAC;QAED,OAAO,EAAE,CAAC;IACX,CAAC;IACD,gBAAgB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC,2BAA2B,KAAK,GAAG;YACrC,CAAC,CAAC,8BAA8B,CAAC;IACnC,CAAC;IACD,gBAAgB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC,sBAAsB,KAAK,QAAQ;YACrC,CAAC,CAAC,8BAA8B,CAAC;IACnC,CAAC;CACD,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAoB;IAE7D,OAAO,EAAE,CAAC;CACV,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAoB;IAE7D,OAAO,EAAE,CAAC;IACV,KAAK,EAAE;QACN,IAAI,EAAE,CAAC;QACP,IAAI,EAAE,oBAAoB;KAC1B;CACD,CAAC;AAYF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACvC,MAAoB,EACpB,kBAA2B,EAClB,EAAE;IACX,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAE1C,MAAM,iBAAiB,GAAG,mBAAmB,CAC5C,WAAW,EACX,MAAM,CAAC,gBAAgB,CACvB,CAAC;IAEF,IAAI,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,eAAe,GAAG,iBAAiB,CACxC,SAAS,EACT,MAAM,CAAC,cAAc,EACrB,kBAAkB,CAClB,CAAC;QACF,OAAO,GAAG,iBAAiB,MAAM,eAAe,IAAI,CAAC;IACtD,CAAC;IAED,OAAO,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC;AACpD,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC3B,WAAoC,EACpC,cAAsC,EAC7B,EAAE;IACX,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;IAEvC,IAAI,QAAQ,KAAK,OAAO,QAAQ,EAAE,CAAC;QAClC,OAAO,UAAU,CAAC,KAAK,KAAK,cAAc;YACzC,CAAC,CAAC,cAAc,QAAQ,GAAG;YAC3B,CAAC,CAAC,gBAAgB,QAAQ,4BAA4B,CAAC;IACzD,CAAC;IAED,OAAO,UAAU,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1E,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACzB,SAAoB,EACpB,cAAsC,EACtC,kBAA2B,EAClB,EAAE;IACX,IAAI,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAE1C,CAAC;IACF,IAAI,aAAa,GAAG,GAAG,CAAC;IAGxB,IAAI,cAAc,KAAK,UAAU,CAAC,MAAM,EAAE,CAAC;QAC1C,YAAY,GAAG,YAAY,CAAC,MAAM,CACjC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CACE,CAAC;QACvC,aAAa,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,IAAI,kBAAkB,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAA2B,YAAY,CAAC,CAAC;QAGjE,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YAC1E,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;YAC5C,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;QAGD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAEnD,EAAE,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/B,CAAC;QACF,CAAC;QAED,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAuB,CAAC;IAExE,OAAO,YAAY;SACjB,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,EAAE,CAC1C,sBAAsB,CACrB,cAAc,EACd,eAAe,EACf,cAAc,EACd,QAAQ,CACR,CACD;SACA,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,aAAa,CAAC,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC9B,SAA0B,EAC1B,UAAmB,EACnB,SAAiC,EACjC,SAA6B,EACpB,EAAE;IACX,IAAI,UAAU,KAAK,OAAO,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,OAAO,sBAAsB,CAAC,SAAS,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC9B,OAAO,cAAc,SAAS,GAAG,CAAC;IACnC,CAAC;IAED,OAAO,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5C,CAAC,CAAC,IAAI,SAAS,KAAK,UAAU,GAAG;QACjC,CAAC,CAAC,IAAI,SAAS,KAAK,UAAU,GAAG,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAgB,EAAU,EAAE,CACjE,wBAAwB;IACxB,MAAM;SACJ,UAAU,CAAC,8BAA8B,CAAC;SAC1C,MAAM,CACN,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAEnC,QAAQ,KAAK,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CACpD,CACD;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AAEjB,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACtC,IAAgB,EACS,EAAE,CAC3B,MAAM,CAAC,WAAW,CACjB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAChE,CAAC"}

package/dist/redis/redisClient.d.ts

@@ -0,0 +1,11 @@
+import type { Logger } from "@prosopo/common";
+import type { RedisClientType } from "redis";
+import { type ZodType } from "zod";
+export declare const REDIS_BATCH_SIZE = 1000;
+export declare const getMissingRedisKeys: (client: RedisClientType, keys: string[]) => Promise<string[]>;
+export declare const fetchRedisHashRecords: (client: RedisClientType, keys: string[], logger: Logger) => Promise<{
+    records: object[];
+    expirations: (number | undefined)[];
+}>;
+export declare const parseRedisRecords: <T>(records: unknown[], recordSchema: ZodType<T>, logger: Logger) => T[];
+//# sourceMappingURL=redisClient.d.ts.map

package/dist/redis/redisClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisClient.d.ts","sourceRoot":"","sources":["../../src/redis/redisClient.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAC7C,OAAO,EAAE,KAAK,OAAO,EAAK,MAAM,KAAK,CAAC;AAEtC,eAAO,MAAM,gBAAgB,OAAQ,CAAC;AAEtC,eAAO,MAAM,mBAAmB,WACvB,eAAe,QACjB,MAAM,EAAE,KACZ,OAAO,CAAC,MAAM,EAAE,CAsBlB,CAAC;AAEF,eAAO,MAAM,qBAAqB,WACzB,eAAe,QACjB,MAAM,EAAE,UACN,MAAM,KACZ,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,WAAW,EAAE,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,CAAA;CAAE,CAgBpE,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,CAAC,WACzB,OAAO,EAAE,gBACJ,OAAO,CAAC,CAAC,CAAC,UAChB,MAAM,KACZ,CAAC,EAcD,CAAC"}

package/dist/redis/redisClient.js

@@ -0,0 +1,67 @@
+import { z } from "zod";
+const REDIS_BATCH_SIZE = 1e3;
+const getMissingRedisKeys = async (client, keys) => {
+  const queries = client.multi();
+  keys.map((key) => {
+    queries.exists(key);
+  });
+  const records = await queries.exec();
+  const missingKeys = [];
+  records.map((exists, recordIndex) => {
+    if ("0" === String(exists)) {
+      const key = keys[recordIndex];
+      if (key) {
+        missingKeys.push(key);
+      }
+    }
+  });
+  return missingKeys;
+};
+const fetchRedisHashRecords = async (client, keys, logger) => {
+  const rulesPipe = client.multi();
+  const expirationPipe = client.multi();
+  for (const key of keys) {
+    rulesPipe.hGetAll(key);
+    expirationPipe.expireTime(key);
+  }
+  const records = await rulesPipe.exec();
+  const expirationRecords = await expirationPipe.exec();
+  return {
+    records,
+    expirations: parseExpirationRecords(expirationRecords, logger)
+  };
+};
+const parseRedisRecords = (records, recordSchema, logger) => records.flatMap((record) => {
+  const parseResult = recordSchema.safeParse(record);
+  if (parseResult.success) {
+    return [parseResult.data];
+  }
+  logger.error(() => ({
+    msg: "Failed to parse Redis record",
+    data: { record, error: parseResult.error }
+  }));
+  return [];
+});
+const expirationRecordSchema = z.coerce.number();
+const UNSET_EXPIRATION_VALUE = -1;
+const parseExpirationRecords = (records, logger) => records.flatMap((record) => {
+  const parseResult = expirationRecordSchema.safeParse(record);
+  if (parseResult.success) {
+    const expiration = UNSET_EXPIRATION_VALUE === parseResult.data ? void 0 : parseResult.data;
+    return [expiration];
+  }
+  logger.error(() => ({
+    msg: "Failed to parse Redis expiration record",
+    data: {
+      record,
+      error: parseResult.error
+    }
+  }));
+  return [void 0];
+});
+export {
+  REDIS_BATCH_SIZE,
+  fetchRedisHashRecords,
+  getMissingRedisKeys,
+  parseRedisRecords
+};

package/dist/redis/redisClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisClient.js","sourceRoot":"","sources":["../../src/redis/redisClient.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EACvC,MAAuB,EACvB,IAAc,EACM,EAAE;IACtB,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAE/B,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAChB,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAc,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAEhD,MAAM,WAAW,GAAa,EAAE,CAAC;IAEjC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE;QACnC,IAAI,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;YAE9B,IAAI,GAAG,EAAE,CAAC;gBACT,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACvB,CAAC;QACF,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,EACzC,MAAuB,EACvB,IAAc,EACd,MAAc,EACwD,EAAE;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IACjC,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IAEtC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvB,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAa,CAAC;IACrD,MAAM,iBAAiB,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAAc,CAAC;IAErE,OAAO;QACN,OAAO,EAAE,OAAO;QAChB,WAAW,EAAE,sBAAsB,CAAC,iBAAiB,EAAE,MAAM,CAAC;KAC9D,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAChC,OAAkB,EAClB,YAAwB,EACxB,MAAc,EACR,EAAE,CACR,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;IAC1B,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAEnD,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACnB,GAAG,EAAE,8BAA8B;QACnC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE;KAC1C,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,CAAC;AACX,CAAC,CAAC,CAAC;AAEJ,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;AAEjD,MAAM,sBAAsB,GAAG,CAAC,CAAC,CAAC;AAElC,MAAM,sBAAsB,GAAG,CAC9B,OAAkB,EAClB,MAAc,EACW,EAAE,CAC3B,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;IAC1B,MAAM,WAAW,GAAG,sBAAsB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAE7D,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,UAAU,GACf,sBAAsB,KAAK,WAAW,CAAC,IAAI;YAC1C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;QAErB,OAAO,CAAC,UAAU,CAAC,CAAC;IACrB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACnB,GAAG,EAAE,yCAAyC;QAC9C,IAAI,EAAE;YACL,MAAM;YACN,KAAK,EAAE,WAAW,CAAC,KAAK;SACxB;KACD,CAAC,CAAC,CAAC;IAGJ,OAAO,CAAC,SAAS,CAAC,CAAC;AACpB,CAAC,CAAC,CAAC"}

package/dist/redis/redisIndex.d.ts

@@ -0,0 +1,9 @@
+import type { RediSearchSchema } from "@redis/search";
+import type { RedisClientType } from "redis";
+export type RedisIndex = {
+    name: string;
+    schema: RediSearchSchema;
+    options: object;
+};
+export declare const createRedisIndex: (client: RedisClientType, index: RedisIndex) => Promise<void>;
+//# sourceMappingURL=redisIndex.d.ts.map

package/dist/redis/redisIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisIndex.d.ts","sourceRoot":"","sources":["../../src/redis/redisIndex.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAc7C,MAAM,MAAM,UAAU,GAAG;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,gBAAgB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CAChB,CAAC;AASF,eAAO,MAAM,gBAAgB,WACpB,eAAe,SAChB,UAAU,KACf,OAAO,CAAC,IAAI,CAkBd,CAAC"}

package/dist/redis/redisIndex.js

@@ -1,22 +1,23 @@
 import crypto from "node:crypto";
 const redisIndexHashesRecordKey = "_index_hashes";
 const redisIndexHashAlgorithm = "sha256";
-const createRedisIndex = async (client, index) => {
-  const indexHash = createIndexHash(index);
-  const existingIndexes = await client.ft._LIST();
-  if (existingIndexes.includes(index.name)) {
-    const existingIndexHash = await fetchIndexHash(client, index.name);
-    if (indexHash === existingIndexHash) {
-      return;
+export const createRedisIndex = async (client, index) => {
+    const indexHash = createIndexHash(index);
+    const existingIndexes = await client.ft._LIST();
+    if (existingIndexes.includes(index.name)) {
+        const existingIndexHash = await fetchIndexHash(client, index.name);
+        if (indexHash === existingIndexHash) {
+            return;
+        }
+        await client.ft.dropIndex(index.name);
     }
-    await client.ft.dropIndex(index.name);
-  }
-  await client.ft.create(index.name, index.schema, index.options);
-  await saveIndexHash(client, index.name, indexHash);
+    await client.ft.create(index.name, index.schema, index.options);
+    await saveIndexHash(client, index.name, indexHash);
 };
-const createIndexHash = (index) => crypto.createHash(redisIndexHashAlgorithm).update(JSON.stringify(index)).digest("hex");
+const createIndexHash = (index) => crypto
+    .createHash(redisIndexHashAlgorithm)
+    .update(JSON.stringify(index))
+    .digest("hex");
 const fetchIndexHash = async (client, indexName) => client.hGet(redisIndexHashesRecordKey, indexName);
 const saveIndexHash = async (client, indexName, indexHash) => client.hSet(redisIndexHashesRecordKey, indexName, indexHash);
-export {
-  createRedisIndex
-};
+//# sourceMappingURL=redisIndex.js.map

package/dist/redis/redisIndex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisIndex.js","sourceRoot":"","sources":["../../src/redis/redisIndex.ts"],"names":[],"mappings":"AAcA,OAAO,MAAM,MAAM,aAAa,CAAC;AA0BjC,MAAM,yBAAyB,GAAG,eAAe,CAAC;AAClD,MAAM,uBAAuB,GAAG,QAAQ,CAAC;AAEzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACpC,MAAuB,EACvB,KAAiB,EACD,EAAE;IAClB,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IAEzC,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAEhD,IAAI,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,iBAAiB,GAAG,MAAM,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAEnE,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;YACrC,OAAO;QACR,CAAC;QAED,MAAM,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAEhE,MAAM,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,KAAiB,EAAU,EAAE,CACrD,MAAM;KACJ,UAAU,CAAC,uBAAuB,CAAC;KACnC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;KAC7B,MAAM,CAAC,KAAK,CAAC,CAAC;AAEjB,MAAM,cAAc,GAAG,KAAK,EAC3B,MAAuB,EACvB,SAAiB,EACQ,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,SAAS,CAAC,CAAC;AAE/E,MAAM,aAAa,GAAG,KAAK,EAC1B,MAAuB,EACvB,SAAiB,EACjB,SAAiB,EACC,EAAE,CACpB,MAAM,CAAC,IAAI,CAAC,yBAAyB,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC"}

package/dist/redis/redisRuleIndex.d.ts

@@ -0,0 +1,13 @@
+import type { RedisIndex } from "@prosopo/redis-client";
+import { type RediSearchSchema } from "@redis/search";
+import type { AccessRule } from "#policy/rule.js";
+export declare const userIpRedisSchema: RediSearchSchema;
+export declare const userAttributesRedisSchema: RediSearchSchema;
+export declare const userScopeRedisSchema: RediSearchSchema;
+export declare const policyScopeRedisSchema: RediSearchSchema;
+export declare const accessRuleRedisSchema: RediSearchSchema;
+export declare const ACCESS_RULES_REDIS_INDEX_NAME = "index:user-access-rules";
+export declare const ACCESS_RULE_REDIS_KEY_PREFIX = "uar:";
+export declare const accessRulesRedisIndex: RedisIndex;
+export declare const getAccessRuleRedisKey: (rule: AccessRule) => string;
+//# sourceMappingURL=redisRuleIndex.d.ts.map

package/dist/redis/redisRuleIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRuleIndex.d.ts","sourceRoot":"","sources":["../../src/redis/redisRuleIndex.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,KAAK,gBAAgB,EAAqB,MAAM,eAAe,CAAC;AACzE,OAAO,KAAK,EACX,UAAU,EAKV,MAAM,iBAAiB,CAAC;AAGzB,eAAO,MAAM,iBAAiB,EAAE,gBAIL,CAAC;AAE5B,eAAO,MAAM,yBAAyB,EAAE,gBAKL,CAAC;AAEpC,eAAO,MAAM,oBAAoB,EAAE,gBAGR,CAAC;AAE5B,eAAO,MAAM,sBAAsB,EAAE,gBAKL,CAAC;AAUjC,eAAO,MAAM,qBAAqB,EAAE,gBAIR,CAAC;AAE7B,eAAO,MAAM,6BAA6B,4BAA4B,CAAC;AAGvE,eAAO,MAAM,4BAA4B,SAAS,CAAC;AAEnD,eAAO,MAAM,qBAAqB,EAAE,UAOnC,CAAC;AAEF,eAAO,MAAM,qBAAqB,SAAU,UAAU,KAAG,MACD,CAAC"}

package/dist/redis/redisRuleIndex.js

@@ -0,0 +1,50 @@
+import { SCHEMA_FIELD_TYPE } from "@redis/search";
+import { makeAccessRuleHash } from "../transformRule.js";
+const userIpRedisSchema = {
+  numericIpMaskMin: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+  numericIpMaskMax: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+  numericIp: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true }
+};
+const userAttributesRedisSchema = {
+  userId: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+  ja4Hash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+  headersHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+  userAgentHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true }
+};
+const userScopeRedisSchema = {
+  ...userAttributesRedisSchema,
+  ...userIpRedisSchema
+};
+const policyScopeRedisSchema = {
+  clientId: {
+    type: SCHEMA_FIELD_TYPE.TAG,
+    INDEXMISSING: true
+  }
+};
+const accessRuleRedisSchema = {
+  ...policyScopeRedisSchema,
+  ...userScopeRedisSchema,
+  groupId: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true }
+};
+const ACCESS_RULES_REDIS_INDEX_NAME = "index:user-access-rules";
+const ACCESS_RULE_REDIS_KEY_PREFIX = "uar:";
+const accessRulesRedisIndex = {
+  name: ACCESS_RULES_REDIS_INDEX_NAME,
+  schema: accessRuleRedisSchema,
+  options: {
+    ON: "HASH",
+    PREFIX: [ACCESS_RULE_REDIS_KEY_PREFIX]
+  }
+};
+const getAccessRuleRedisKey = (rule) => ACCESS_RULE_REDIS_KEY_PREFIX + makeAccessRuleHash(rule);
+export {
+  ACCESS_RULES_REDIS_INDEX_NAME,
+  ACCESS_RULE_REDIS_KEY_PREFIX,
+  accessRuleRedisSchema,
+  accessRulesRedisIndex,
+  getAccessRuleRedisKey,
+  policyScopeRedisSchema,
+  userAttributesRedisSchema,
+  userIpRedisSchema,
+  userScopeRedisSchema
+};

package/dist/redis/redisRuleIndex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRuleIndex.js","sourceRoot":"","sources":["../../src/redis/redisRuleIndex.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAyB,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAQzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,MAAM,CAAC,MAAM,iBAAiB,GAAqB;IAClD,gBAAgB,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;IACzE,gBAAgB,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;IACzE,SAAS,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;CACxC,CAAC;AAE5B,MAAM,CAAC,MAAM,yBAAyB,GAAqB;IAC1D,MAAM,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAC3D,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAC5D,WAAW,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;IAChE,aAAa,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;CAChC,CAAC;AAEpC,MAAM,CAAC,MAAM,oBAAoB,GAAqB;IACrD,GAAG,yBAAyB;IAC5B,GAAG,iBAAiB;CACM,CAAC;AAE5B,MAAM,CAAC,MAAM,sBAAsB,GAAqB;IACvD,QAAQ,EAAE;QACT,IAAI,EAAE,iBAAiB,CAAC,GAAG;QAC3B,YAAY,EAAE,IAAI;KAClB;CAC8B,CAAC;AAUjC,MAAM,CAAC,MAAM,qBAAqB,GAAqB;IACtD,GAAG,sBAAsB;IACzB,GAAG,oBAAoB;IACvB,OAAO,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE;CACjC,CAAC;AAE7B,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAC;AAGvE,MAAM,CAAC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAEnD,MAAM,CAAC,MAAM,qBAAqB,GAAe;IAChD,IAAI,EAAE,6BAA6B;IACnC,MAAM,EAAE,qBAAqB;IAC7B,OAAO,EAAE;QACR,EAAE,EAAE,MAAe;QACnB,MAAM,EAAE,CAAC,4BAA4B,CAAC;KACtC;CACD,CAAC;AAEF,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,IAAgB,EAAU,EAAE,CACjE,4BAA4B,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC"}

package/dist/redis/redisRulesIndex.d.ts

@@ -0,0 +1,9 @@
+import type { RedisIndex } from "@prosopo/redis-client";
+import { type FtSearchOptions } from "@redis/search";
+import { type PolicyFilter } from "#policy/accessPolicyResolver.js";
+export declare const redisRulesIndexName = "index:user-access-rules";
+export declare const redisRuleKeyPrefix = "uar:";
+export declare const redisAccessRulesIndex: RedisIndex;
+export declare const redisRulesSearchOptions: FtSearchOptions;
+export declare const getRedisRulesQuery: (filter: PolicyFilter, matchingFieldsOnly: boolean) => string;
+//# sourceMappingURL=redisRulesIndex.d.ts.map

package/dist/redis/redisRulesIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesIndex.d.ts","sourceRoot":"","sources":["../../src/redis/redisRulesIndex.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,KAAK,eAAe,EAAqB,MAAM,eAAe,CAAC;AAMxE,OAAO,EAAE,KAAK,YAAY,EAAc,MAAM,iCAAiC,CAAC;AAGhF,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAE7D,eAAO,MAAM,kBAAkB,SAAS,CAAC;AAEzC,eAAO,MAAM,qBAAqB,EAAE,UA6BnC,CAAC;AA8CF,eAAO,MAAM,uBAAuB,EAAE,eAGrC,CAAC;AAYF,eAAO,MAAM,kBAAkB,WACtB,YAAY,sBACA,OAAO,KACzB,MAkBF,CAAC"}

package/dist/redis/redisRulesIndex.js

@@ -0,0 +1,138 @@
+import { SCHEMA_FIELD_TYPE } from "@redis/search";
+import { userScopeSchema } from "../accessPolicy.js";
+import { ScopeMatch } from "../accessPolicyResolver.js";
+const redisRulesIndexName = "index:user-access-rules";
+const redisRuleKeyPrefix = "uar:";
+const redisAccessRulesIndex = {
+  name: redisRulesIndexName,
+  /**
+   * Note on the field type decision
+   *
+   * TAG is designed for the exact value matching
+   * TEXT is designed for the word-based and pattern matching
+   *
+   * For our goal TAG fits perfectly and, more performant
+   */
+  schema: {
+    clientId: {
+      type: SCHEMA_FIELD_TYPE.TAG,
+      // necessary to make possible use of the ismissing() function on this field in the search
+      INDEXMISSING: true
+    },
+    numericIpMaskMin: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+    numericIpMaskMax: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+    userId: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    numericIp: { type: SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+    ja4Hash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    headersHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+    userAgentHash: { type: SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true }
+  },
+  // the satisfy statement is to guarantee that the keys are right
+  options: {
+    ON: "HASH",
+    PREFIX: [redisRuleKeyPrefix]
+  }
+};
+const numericIndexFields = [
+  "numericIp",
+  "numericIpMaskMin",
+  "numericIpMaskMax"
+];
+const greedyFieldComparisons = {
+  numericIp: (value, scope) => {
+    if (value !== void 0) {
+      return `( @numericIp:[${value}] | ( @numericIpMaskMin:[-inf ${value}] @numericIpMaskMax:[${value} +inf] ) )`;
+    }
+    if (scope.numericIpMaskMin === void 0 && scope.numericIpMaskMax === void 0) {
+      return "ismissing(@numericIp) ismissing(@numericIpMaskMin) ismissing(@numericIpMaskMax)";
+    }
+    return "";
+  },
+  numericIpMaskMin: (value, scope) => {
+    if (scope.numericIp !== void 0) {
+      return "";
+    }
+    return value !== void 0 ? `@numericIpMaskMin:[-inf ${value}]` : "ismissing(@numericIpMaskMin)";
+  },
+  numericIpMaskMax: (value, scope) => {
+    if (scope.numericIp !== void 0) {
+      return "";
+    }
+    return value !== void 0 ? `@numericIpMaskMax:[${value} +inf]` : "ismissing(@numericIpMaskMax)";
+  }
+};
+const redisRulesSearchOptions = {
+  // #2 is a required option when the 'ismissing()' function is in the query body
+  DIALECT: 2
+};
+const getRedisRulesQuery = (filter, matchingFieldsOnly) => {
+  const { policyScope, userScope } = filter;
+  const policyScopeFilter = getPolicyScopeQuery(
+    policyScope,
+    filter.policyScopeMatch
+  );
+  if (userScope && Object.keys(userScope).length > 0) {
+    const userScopeFilter = getUserScopeQuery(
+      userScope,
+      filter.userScopeMatch,
+      matchingFieldsOnly
+    );
+    return `${policyScopeFilter} ( ${userScopeFilter} )`;
+  }
+  return policyScopeFilter ? policyScopeFilter : "*";
+};
+const getPolicyScopeQuery = (policyScope, scopeMatchType) => {
+  const clientId = policyScope?.clientId;
+  if ("string" === typeof clientId) {
+    return ScopeMatch.Exact === scopeMatchType ? `@clientId:{${clientId}}` : `( @clientId:{${clientId}} | ismissing(@clientId) )`;
+  }
+  return ScopeMatch.Exact === scopeMatchType ? "ismissing(@clientId)" : "";
+};
+const getUserScopeQuery = (userScope, scopeMatchType, matchingFieldsOnly) => {
+  let scopeEntries = Object.entries(userScope);
+  let scopeJoinType = " ";
+  if (scopeMatchType === ScopeMatch.Greedy) {
+    scopeEntries = scopeEntries.filter(
+      ([_, value]) => value !== void 0
+    );
+    scopeJoinType = " | ";
+  }
+  if (matchingFieldsOnly) {
+    const scopeMap = new Map(scopeEntries);
+    if (scopeMap.has("numericIp") && scopeMap.get("numericIp") === void 0) {
+      scopeMap.set("numericIpMaskMin", void 0);
+      scopeMap.set("numericIpMaskMax", void 0);
+    }
+    for (const name of Object.keys(userScopeSchema.shape)) {
+      if (!scopeMap.has(name)) {
+        scopeMap.set(name, void 0);
+      }
+    }
+    scopeEntries = [...scopeMap.entries()];
+  }
+  const scopeObj = Object.fromEntries(scopeEntries);
+  return scopeEntries.map(
+    ([scopeFieldName, scopeFieldValue]) => getUserScopeFieldQuery(
+      scopeFieldName,
+      scopeFieldValue,
+      scopeMatchType,
+      scopeObj
+    )
+  ).filter(Boolean).join(scopeJoinType);
+};
+const getUserScopeFieldQuery = (fieldName, fieldValue, matchType, fullScope) => {
+  if ("function" === typeof greedyFieldComparisons[fieldName]) {
+    return greedyFieldComparisons[fieldName](fieldValue, fullScope);
+  }
+  if (fieldValue === void 0) {
+    return `ismissing(@${fieldName})`;
+  }
+  return numericIndexFields.includes(fieldName) ? `@${fieldName}:[${fieldValue}]` : `@${fieldName}:{${fieldValue}}`;
+};
+export {
+  getRedisRulesQuery,
+  redisAccessRulesIndex,
+  redisRuleKeyPrefix,
+  redisRulesIndexName,
+  redisRulesSearchOptions
+};