@prosopo/user-access-policy 3.4.0 → 3.5.27

package/dist/ruleInput/ruleInput.js

@@ -0,0 +1,50 @@
+import { z } from "zod";
+import { FilterScopeMatch } from "../rulesStorage.js";
+import { policyScopeInput, accessPolicyInput } from "./policyInput.js";
+import { userScopeInput } from "./userScopeInput.js";
+const ruleGroupInput = z.object({
+  groupId: z.coerce.string().optional(),
+  ruleGroupId: z.coerce.string().optional()
+}).transform((ruleGroupInput2) => {
+  const { ruleGroupId, ...ruleGroup } = ruleGroupInput2;
+  if ("string" === typeof ruleGroupId) {
+    ruleGroup.groupId = ruleGroupId;
+  }
+  return ruleGroup;
+});
+const accessRuleInput = z.object({
+  ...accessPolicyInput.shape,
+  ...policyScopeInput.shape
+}).and(userScopeInput).and(ruleGroupInput).transform((ruleInput) => ruleInput);
+const ruleEntryInput = z.object({
+  rule: accessRuleInput,
+  expiresUnixTimestamp: z.coerce.number().optional()
+});
+const accessRulesFilterInput = z.object({
+  policyScope: policyScopeInput.optional(),
+  policyScopes: z.array(policyScopeInput).optional(),
+  policyScopeMatch: z.nativeEnum(FilterScopeMatch).default(FilterScopeMatch.Exact),
+  userScope: userScopeInput.optional(),
+  userScopeMatch: z.nativeEnum(FilterScopeMatch).default(FilterScopeMatch.Exact),
+  groupId: z.string().optional()
+});
+const getAccessRuleFiltersFromInput = (filterInput) => {
+  const { policyScopes, policyScope, ...filterBase } = filterInput;
+  const allPolicyScopes = policyScopes || [];
+  if (policyScope) {
+    allPolicyScopes.push(policyScope);
+  }
+  if (allPolicyScopes.length > 0) {
+    return allPolicyScopes.map((policyScope2) => ({
+      ...filterBase,
+      policyScope: policyScope2
+    }));
+  }
+  return [filterBase];
+};
+export {
+  accessRuleInput,
+  accessRulesFilterInput,
+  getAccessRuleFiltersFromInput,
+  ruleEntryInput
+};

package/dist/ruleInput/ruleInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleInput.js","sourceRoot":"","sources":["../../src/ruleInput/ruleInput.ts"],"names":[],"mappings":"AAeA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAEtC,OAAO,EAGN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAuB,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAY1E,MAAM,cAAc,GAAG,CAAC;KACtB,MAAM,CAAC;IACP,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACP,CAAC;KACnC,SAAS,CAAC,CAAC,cAA8B,EAAE,EAAE;IAC7C,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,EAAE,GAAG,cAAc,CAAC;IAErD,IAAI,QAAQ,KAAK,OAAO,WAAW,EAAE,CAAC;QACrC,SAAS,CAAC,OAAO,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,eAAe,GAAwB,CAAC;KACnD,MAAM,CAAC;IACP,GAAG,iBAAiB,CAAC,KAAK;IAC1B,GAAG,gBAAgB,CAAC,KAAK;CACzB,CAAC;KACD,GAAG,CAAC,cAAc,CAAC;KACnB,GAAG,CAAC,cAAc,CAAC;KAEnB,SAAS,CAAC,CAAC,SAA0B,EAAc,EAAE,CAAC,SAAS,CAAC,CAAC;AAEnE,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,eAAe;IACrB,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACf,CAAoC,CAAC;AAOzE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,WAAW,EAAE,gBAAgB,CAAC,QAAQ,EAAE;IACxC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAClD,gBAAgB,EAAE,CAAC;SACjB,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,SAAS,EAAE,cAAc,CAAC,QAAQ,EAAE;IACpC,cAAc,EAAE,CAAC;SACf,UAAU,CAAC,gBAAgB,CAAC;SAC5B,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACY,CAA2C,CAAC;AAEvF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,WAAmC,EACb,EAAE;IACxB,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,GAAG,UAAU,EAAE,GAAG,WAAW,CAAC;IAEjE,MAAM,eAAe,GAAG,YAAY,IAAI,EAAE,CAAC;IAE3C,IAAI,WAAW,EAAE,CAAC;QACjB,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC5C,GAAG,UAAU;YACb,WAAW;SACX,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC,CAAC"}

package/dist/ruleInput/userScopeInput.d.ts

@@ -0,0 +1,93 @@
+import { z } from "zod";
+import type { UserAttributes, UserIp } from "#policy/rule.js";
+import type { UserAttributesRecord, UserIpRecord } from "#policy/ruleRecord.js";
+export type UserAttributesInput = UserAttributes & UserAttributesRecord;
+export type UserIpInput = UserIp & UserIpRecord;
+export type UserScopeInput = UserAttributesInput & UserIpInput;
+export declare const userScopeSchema: z.ZodObject<{
+    userId: z.ZodOptional<z.ZodString>;
+    ja4Hash: z.ZodOptional<z.ZodString>;
+    headersHash: z.ZodOptional<z.ZodString>;
+    userAgentHash: z.ZodOptional<z.ZodString>;
+    numericIp: z.ZodOptional<z.ZodBigInt>;
+    numericIpMaskMin: z.ZodOptional<z.ZodBigInt>;
+    numericIpMaskMax: z.ZodOptional<z.ZodBigInt>;
+}, "strip", z.ZodTypeAny, {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+}, {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+}>;
+export declare const userScopeInput: z.ZodEffects<z.ZodIntersection<z.ZodIntersection<z.ZodObject<{}, "strip", z.ZodTypeAny, {}, {}>, z.ZodEffects<z.ZodObject<{
+    ip: z.ZodOptional<z.ZodString>;
+    ipMask: z.ZodOptional<z.ZodString>;
+    numericIp: z.ZodOptional<z.ZodBigInt>;
+    numericIpMaskMin: z.ZodOptional<z.ZodBigInt>;
+    numericIpMaskMax: z.ZodOptional<z.ZodBigInt>;
+}, "strip", z.ZodTypeAny, {
+    ip?: string | undefined;
+    ipMask?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+}, {
+    ip?: string | undefined;
+    ipMask?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+}>, UserIp, {
+    ip?: string | undefined;
+    ipMask?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+}>>, z.ZodEffects<z.ZodObject<{
+    userAgent: z.ZodOptional<z.ZodString>;
+    userId: z.ZodOptional<z.ZodString>;
+    ja4Hash: z.ZodOptional<z.ZodString>;
+    headersHash: z.ZodOptional<z.ZodString>;
+    userAgentHash: z.ZodOptional<z.ZodString>;
+}, "strip", z.ZodTypeAny, {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    userAgent?: string | undefined;
+}, {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    userAgent?: string | undefined;
+}>, UserAttributes, {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    userAgent?: string | undefined;
+}>>, UserScopeInput, {} & {
+    ip?: string | undefined;
+    ipMask?: string | undefined;
+    numericIp?: bigint | undefined;
+    numericIpMaskMin?: bigint | undefined;
+    numericIpMaskMax?: bigint | undefined;
+} & {
+    userAgentHash?: string | undefined;
+    userId?: string | undefined;
+    ja4Hash?: string | undefined;
+    headersHash?: string | undefined;
+    userAgent?: string | undefined;
+}>;
+//# sourceMappingURL=userScopeInput.d.ts.map

package/dist/ruleInput/userScopeInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userScopeInput.d.ts","sourceRoot":"","sources":["../../src/ruleInput/userScopeInput.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AACtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,EAAa,MAAM,iBAAiB,CAAC;AACzE,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEhF,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,oBAAoB,CAAC;AA6BxE,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,YAAY,CAAC;AAsChD,MAAM,MAAM,cAAc,GAAG,mBAAmB,GAAG,WAAW,CAAC;AAE/D,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;EAGgC,CAAC;AAE7D,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAQzB,CAAC"}

package/dist/ruleInput/userScopeInput.js

@@ -0,0 +1,55 @@
+import crypto from "node:crypto";
+import { getIPAddress } from "@prosopo/util";
+import { Address4 } from "ip-address";
+import { z } from "zod";
+const userAttributesSchema = z.object({
+  // coerce is used for safety, as e.g., incoming userId can be digital
+  userId: z.coerce.string().optional(),
+  ja4Hash: z.coerce.string().optional(),
+  headersHash: z.coerce.string().optional(),
+  userAgentHash: z.coerce.string().optional()
+});
+const userAttributesInput = z.object({
+  ...userAttributesSchema.shape,
+  userAgent: z.coerce.string().optional()
+}).transform((userAttributesInput2) => {
+  const { userAgent, ...userScope } = userAttributesInput2;
+  if ("string" === typeof userAgent) {
+    userScope.userAgentHash = hashUserAgent(userAgent);
+  }
+  return userScope;
+});
+const hashUserAgent = (userAgent) => crypto.createHash("sha256").update(userAgent).digest("hex");
+const userIpSchema = z.object({
+  numericIp: z.coerce.bigint().optional(),
+  numericIpMaskMin: z.coerce.bigint().optional(),
+  numericIpMaskMax: z.coerce.bigint().optional()
+});
+const userIpInput = z.object({
+  ...userIpSchema.shape,
+  ip: z.string().optional(),
+  ipMask: z.string().optional()
+}).transform((userIpInput2) => {
+  const { ip, ipMask, ...numericUserIp } = userIpInput2;
+  if ("string" === typeof ip) {
+    numericUserIp.numericIp = getIPAddress(ip).bigInt();
+  }
+  if ("string" === typeof ipMask) {
+    const ipObject = new Address4(ipMask);
+    numericUserIp.numericIpMaskMin = ipObject.startAddress().bigInt();
+    numericUserIp.numericIpMaskMax = ipObject.endAddress().bigInt();
+  }
+  return numericUserIp;
+});
+const userScopeSchema = z.object({
+  ...userIpSchema.shape,
+  ...userAttributesSchema.shape
+});
+const userScopeInput = z.object({}).and(userIpInput).and(userAttributesInput).transform(
+  // transform is used for type safety only - plain "satisfies ZodType<x>" doesn't work after ".and()"
+  (userScopeInput2) => userScopeInput2
+);
+export {
+  userScopeInput,
+  userScopeSchema
+};

package/dist/ruleInput/userScopeInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userScopeInput.js","sourceRoot":"","sources":["../../src/ruleInput/userScopeInput.ts"],"names":[],"mappings":"AAcA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAgB,CAAC,EAAE,MAAM,KAAK,CAAC;AAMtC,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IAErC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACpC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACrC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACT,CAAmC,CAAC;AAEvE,MAAM,mBAAmB,GAAG,CAAC;KAC3B,MAAM,CAAC;IACP,GAAG,oBAAoB,CAAC,KAAK;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACA,CAAC;KACxC,SAAS,CAAC,CAAC,mBAAwC,EAAkB,EAAE;IAEvE,MAAM,EAAE,SAAS,EAAE,GAAG,SAAS,EAAE,GAAG,mBAAmB,CAAC;IAExD,IAAI,QAAQ,KAAK,OAAO,SAAS,EAAE,CAAC;QACnC,SAAS,CAAC,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC,CAAC;AAEJ,MAAM,aAAa,GAAG,CAAC,SAAiB,EAAU,EAAE,CACnD,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAI7D,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACvC,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACpB,CAA2B,CAAC;AAEvD,MAAM,WAAW,GAAG,CAAC;KACnB,MAAM,CAAC;IACP,GAAG,YAAY,CAAC,KAAK;IACrB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACE,CAAC;KAChC,SAAS,CAAC,CAAC,WAAwB,EAAU,EAAE;IAE/C,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,GAAG,WAAW,CAAC;IAErD,IAAI,QAAQ,KAAK,OAAO,EAAE,EAAE,CAAC;QAC5B,aAAa,CAAC,SAAS,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrD,CAAC;IAGD,IAAI,QAAQ,KAAK,OAAO,MAAM,EAAE,CAAC;QAGhC,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QAGtC,aAAa,CAAC,gBAAgB,GAAG,QAAQ,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,CAAC;QAGlE,aAAa,CAAC,gBAAgB,GAAG,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,CAAC;IACjE,CAAC;IAED,OAAO,aAAa,CAAC;AACtB,CAAC,CAAC,CAAC;AAIJ,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IACvC,GAAG,YAAY,CAAC,KAAK;IACrB,GAAG,oBAAoB,CAAC,KAAK;CACA,CAA8B,CAAC;AAE7D,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC;KAC7B,MAAM,CAAC,EAAE,CAAC;KAEV,GAAG,CAAC,WAAW,CAAC;KAChB,GAAG,CAAC,mBAAmB,CAAC;KACxB,SAAS,CAET,CAAC,cAAc,EAAkB,EAAE,CAAC,cAAc,CAClD,CAAC"}

package/dist/ruleRecord.d.ts

@@ -0,0 +1,18 @@
+import type { AccessPolicy, PolicyScope, UserAttributes } from "#policy/rule.js";
+export type UserAttributesRecord = Omit<UserAttributes, "userAgentHash"> & {
+    userAgent?: string;
+};
+export declare const userAttributesRecordFields: ["userId", "ja4Hash", "headersHash", "userAgent"];
+export type UserIpRecord = {
+    ip?: string;
+    ipMask?: string;
+};
+export declare const userIpRecordFields: ["ip", "ipMask"];
+export type UserScopeRecord = UserAttributesRecord & UserIpRecord;
+export declare const userScopeRecordFields: ["userId", "ja4Hash", "headersHash", "userAgent", "ip", "ipMask"];
+export type UserScopeRecordField = (typeof userScopeRecordFields)[number];
+export type AccessRuleRecord = AccessPolicy & PolicyScope & UserScopeRecord & {
+    ruleGroupId?: string;
+};
+export declare const getUserScopeRecordFromAccessRuleRecord: (ruleRecord: AccessRuleRecord) => UserScopeRecord;
+//# sourceMappingURL=ruleRecord.d.ts.map

package/dist/ruleRecord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleRecord.d.ts","sourceRoot":"","sources":["../src/ruleRecord.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EACX,YAAY,EACZ,WAAW,EACX,cAAc,EACd,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,oBAAoB,GAAG,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,GAAG;IAC1E,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,eAAO,MAAM,0BAA0B,mDAKY,CAAC;AAEpD,MAAM,MAAM,YAAY,GAAG;IAE1B,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,eAAO,MAAM,kBAAkB,kBAGY,CAAC;AAE5C,MAAM,MAAM,eAAe,GAAG,oBAAoB,GAAG,YAAY,CAAC;AAElE,eAAO,MAAM,qBAAqB,mEAGY,CAAC;AAE/C,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,MAAM,MAAM,gBAAgB,GAAG,YAAY,GAC1C,WAAW,GACX,eAAe,GAAG;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEH,eAAO,MAAM,sCAAsC,eACtC,gBAAgB,KAC1B,eAKD,CAAC"}

package/dist/ruleRecord.js

@@ -0,0 +1,23 @@
+const userAttributesRecordFields = [
+  "userId",
+  "ja4Hash",
+  "headersHash",
+  "userAgent"
+];
+const userIpRecordFields = [
+  "ip",
+  "ipMask"
+];
+const userScopeRecordFields = [
+  ...userAttributesRecordFields,
+  ...userIpRecordFields
+];
+const getUserScopeRecordFromAccessRuleRecord = (ruleRecord) => Object.fromEntries(
+  userScopeRecordFields.map((field) => [field, ruleRecord[field]]).filter(([, value]) => value !== void 0)
+);
+export {
+  getUserScopeRecordFromAccessRuleRecord,
+  userAttributesRecordFields,
+  userIpRecordFields,
+  userScopeRecordFields
+};

package/dist/ruleRecord.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ruleRecord.js","sourceRoot":"","sources":["../src/ruleRecord.ts"],"names":[],"mappings":"AAwBA,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACzC,QAAQ;IACR,SAAS;IACT,aAAa;IACb,WAAW;CACuC,CAAC;AASpD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IACjC,IAAI;IACJ,QAAQ;CACkC,CAAC;AAI5C,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,GAAG,0BAA0B;IAC7B,GAAG,kBAAkB;CACwB,CAAC;AAU/C,MAAM,CAAC,MAAM,sCAAsC,GAAG,CACrD,UAA4B,EACV,EAAE,CACpB,MAAM,CAAC,WAAW,CACjB,qBAAqB;KACnB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;KAC1C,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAC5C,CAAC"}

package/dist/rulesStorage.d.ts

@@ -0,0 +1,30 @@
+import type { AccessRule, PolicyScope, UserScope } from "#policy/rule.js";
+export declare enum FilterScopeMatch {
+    Exact = "exact",
+    Greedy = "greedy"
+}
+export type AccessRulesFilter = {
+    policyScope?: PolicyScope;
+    policyScopeMatch?: FilterScopeMatch;
+    userScope?: UserScope;
+    userScopeMatch?: FilterScopeMatch;
+    groupId?: string;
+};
+export type AccessRuleEntry = {
+    rule: AccessRule;
+    expiresUnixTimestamp?: number;
+};
+export type AccessRulesReader = {
+    fetchRules(ruleIds: string[]): Promise<AccessRuleEntry[]>;
+    getMissingRuleIds(ruleIds: string[]): Promise<string[]>;
+    findRules(filter: AccessRulesFilter, matchingFieldsOnly?: boolean, skipEmptyUserScopes?: boolean): Promise<AccessRule[]>;
+    findRuleIds(filter: AccessRulesFilter, matchingFieldsOnly?: boolean): Promise<string[]>;
+    fetchAllRuleIds(batchHandler: (ruleIds: string[]) => Promise<void>): Promise<void>;
+};
+export type AccessRulesWriter = {
+    insertRules(ruleEntries: AccessRuleEntry[]): Promise<string[]>;
+    deleteRules(ruleIds: string[]): Promise<void>;
+    deleteAllRules(): Promise<number>;
+};
+export type AccessRulesStorage = AccessRulesReader & AccessRulesWriter;
+//# sourceMappingURL=rulesStorage.d.ts.map

package/dist/rulesStorage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulesStorage.d.ts","sourceRoot":"","sources":["../src/rulesStorage.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE1E,oBAAY,gBAAgB;IAC3B,KAAK,UAAU;IACf,MAAM,WAAW;CACjB;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC/B,WAAW,CAAC,EAAE,WAAW,CAAC;IAK1B,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,SAAS,CAAC,EAAE,SAAS,CAAC;IAKtB,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAE1D,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAExD,SAAS,CACR,MAAM,EAAE,iBAAiB,EACzB,kBAAkB,CAAC,EAAE,OAAO,EAC5B,mBAAmB,CAAC,EAAE,OAAO,GAC3B,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAEzB,WAAW,CACV,MAAM,EAAE,iBAAiB,EACzB,kBAAkB,CAAC,EAAE,OAAO,GAC1B,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAErB,eAAe,CACd,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAChD,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC/B,WAAW,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE/D,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9C,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG,iBAAiB,GAAG,iBAAiB,CAAC"}

package/dist/rulesStorage.js

@@ -0,0 +1,8 @@
+var FilterScopeMatch = /* @__PURE__ */ ((FilterScopeMatch2) => {
+  FilterScopeMatch2["Exact"] = "exact";
+  FilterScopeMatch2["Greedy"] = "greedy";
+  return FilterScopeMatch2;
+})(FilterScopeMatch || {});
+export {
+  FilterScopeMatch
+};

package/dist/rulesStorage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rulesStorage.js","sourceRoot":"","sources":["../src/rulesStorage.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAN,IAAY,gBAGX;AAHD,WAAY,gBAAgB;IAC3B,mCAAe,CAAA;IACf,qCAAiB,CAAA;AAClB,CAAC,EAHW,gBAAgB,KAAhB,gBAAgB,QAG3B"}

package/dist/tests/accessPolicy.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=accessPolicy.test.d.ts.map

package/dist/tests/accessPolicy.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessPolicy.test.d.ts","sourceRoot":"","sources":["../../src/tests/accessPolicy.test.ts"],"names":[],"mappings":""}

package/dist/tests/accessPolicy.test.js

@@ -0,0 +1,27 @@
+import { describe, expect, test } from "vitest";
+import { userScopeInputSchema } from "#policy/accessPolicy.js";
+describe("accessPolicy", () => {
+    describe("userScopeInputSchema", () => {
+        test("turns ip into numericIp", () => {
+            const userScope = userScopeInputSchema.parse({
+                ip: "127.0.0.1",
+                numericIp: "123",
+            });
+            expect(userScope).toEqual({
+                numericIp: BigInt(2130706433),
+            });
+        });
+        test("turns ipMask into numericIpMask", () => {
+            const userScope = userScopeInputSchema.parse({
+                ipMask: "127.0.0.1/24",
+                numericIpMaskMin: 1,
+                numericIpMaskMax: 2,
+            });
+            expect(userScope).toEqual({
+                numericIpMaskMin: BigInt(2130706432),
+                numericIpMaskMax: BigInt(2130706687),
+            });
+        });
+    });
+});
+//# sourceMappingURL=accessPolicy.test.js.map

package/dist/tests/accessPolicy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessPolicy.test.js","sourceRoot":"","sources":["../../src/tests/accessPolicy.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC7B,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;QACrC,IAAI,CAAC,yBAAyB,EAAE,GAAG,EAAE;YACpC,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC;gBAC5C,EAAE,EAAE,WAAW;gBACf,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;YAEH,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;gBACzB,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC;aAC7B,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,iCAAiC,EAAE,GAAG,EAAE;YAC5C,MAAM,SAAS,GAAG,oBAAoB,CAAC,KAAK,CAAC;gBAC5C,MAAM,EAAE,cAAc;gBACtB,gBAAgB,EAAE,CAAC;gBACnB,gBAAgB,EAAE,CAAC;aACnB,CAAC,CAAC;YAEH,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC;gBACzB,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC;gBACpC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC;aACpC,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tests/redis/reader/redisRulesQuery.unit.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=redisRulesQuery.unit.test.d.ts.map

package/dist/tests/redis/reader/redisRulesQuery.unit.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesQuery.unit.test.d.ts","sourceRoot":"","sources":["../../../../src/tests/redis/reader/redisRulesQuery.unit.test.ts"],"names":[],"mappings":""}

package/dist/tests/redis/reader/redisRulesQuery.unit.test.js

@@ -0,0 +1,101 @@
+import { describe, expect, it } from "vitest";
+import { getRulesRedisQuery } from "#policy/redis/reader/redisRulesQuery.js";
+import { FilterScopeMatch, } from "#policy/rulesStorage.js";
+describe("getRulesRedisQuery", () => {
+    it("puts ismissing(x) for field x passed in as `undefined` when user scope match is exact", () => {
+        const filter = {
+            userScope: {
+                numericIp: BigInt(100),
+                ja4Hash: "ja4Hash",
+                userAgentHash: undefined,
+            },
+            userScopeMatch: FilterScopeMatch.Exact,
+        };
+        const query = getRulesRedisQuery(filter, false);
+        expect(query).toBe("( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) )");
+    });
+    it("puts ismissing(x) for field x passed in as `undefined` when user scope match is exact and for missing fields when matchingFieldsOnly is set", () => {
+        const filter = {
+            userScope: {
+                numericIp: BigInt(100),
+                ja4Hash: "ja4Hash",
+                userAgentHash: undefined,
+            },
+            userScopeMatch: FilterScopeMatch.Exact,
+        };
+        const query = getRulesRedisQuery(filter, true);
+        expect(query).toBe("( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@userId) ismissing(@headersHash) )");
+    });
+    it("puts ismissing(x) for multiple fields passed in as `undefined` when user scope match is exact", () => {
+        const filter = {
+            userScope: {
+                numericIp: BigInt(100),
+                ja4Hash: "ja4Hash",
+                userAgentHash: undefined,
+                headersHash: undefined,
+                userId: undefined,
+            },
+            userScopeMatch: FilterScopeMatch.Exact,
+        };
+        const query = getRulesRedisQuery(filter, false);
+        expect(query).toBe("( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) )");
+    });
+    it("does not put ismissing(x) for multiple fields passed in as `undefined` when user scope match is greedy", () => {
+        const filter = {
+            userScope: {
+                numericIp: BigInt(100),
+                ja4Hash: "ja4Hash",
+                userAgentHash: undefined,
+                headersHash: undefined,
+                userId: undefined,
+            },
+            userScopeMatch: FilterScopeMatch.Greedy,
+        };
+        const query = getRulesRedisQuery(filter, false);
+        expect(query).toBe("( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) | @ja4Hash:{ja4Hash} )");
+    });
+    it("puts ismissing(x) for multiple fields passed in as `undefined` when user scope match is exact 2", () => {
+        const filter = {
+            userScope: {
+                numericIp: undefined,
+                ja4Hash: "ja4Hash",
+                userAgentHash: undefined,
+                headersHash: undefined,
+                userId: undefined,
+            },
+            userScopeMatch: FilterScopeMatch.Exact,
+        };
+        const query = getRulesRedisQuery(filter, false);
+        expect(query).toBe("( ismissing(@numericIp) ismissing(@numericIpMaskMin) ismissing(@numericIpMaskMax) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) )");
+    });
+    it("does not put ismissing(numericIpMaskMin) and does not put ismissing(numericIpMaskMax) when numericIp is passed in", () => {
+        const filter = {
+            userScope: {
+                numericIp: BigInt(100),
+                ja4Hash: "ja4Hash",
+                userAgentHash: undefined,
+                headersHash: undefined,
+                userId: undefined,
+            },
+            userScopeMatch: FilterScopeMatch.Exact,
+        };
+        const query = getRulesRedisQuery(filter, true);
+        expect(query).toBe("( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) )");
+    });
+    it("does not put ismissing(numericIp) when numericIpMaskMin and numericIpMaskMax are passed in", () => {
+        const filter = {
+            userScope: {
+                numericIpMaskMin: BigInt(100),
+                numericIpMaskMax: BigInt(200),
+                ja4Hash: "ja4Hash",
+                userAgentHash: undefined,
+                headersHash: undefined,
+                userId: undefined,
+            },
+            userScopeMatch: FilterScopeMatch.Exact,
+        };
+        const query = getRulesRedisQuery(filter, true);
+        expect(query).toBe("( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[200 +inf] @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) )");
+    });
+});
+//# sourceMappingURL=redisRulesQuery.unit.test.js.map

package/dist/tests/redis/reader/redisRulesQuery.unit.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesQuery.unit.test.js","sourceRoot":"","sources":["../../../../src/tests/redis/reader/redisRulesQuery.unit.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yCAAyC,CAAC;AAC7E,OAAO,EAEN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AAEjC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAChG,MAAM,MAAM,GAAG;YACd,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;gBACtB,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,SAAS;aACxB;YACD,cAAc,EAAE,gBAAgB,CAAC,KAAK;SACjB,CAAC;QAEvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CACjB,2IAA2I,CAC3I,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6IAA6I,EAAE,GAAG,EAAE;QACtJ,MAAM,MAAM,GAAG;YACd,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;gBACtB,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,SAAS;aACxB;YACD,cAAc,EAAE,gBAAgB,CAAC,KAAK;SACjB,CAAC;QAEvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE/C,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CACjB,sLAAsL,CACtL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+FAA+F,EAAE,GAAG,EAAE;QACxG,MAAM,MAAM,GAAG;YACd,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;gBACtB,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,SAAS;gBACxB,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,SAAS;aACjB;YACD,cAAc,EAAE,gBAAgB,CAAC,KAAK;SACjB,CAAC;QAEvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CACjB,sLAAsL,CACtL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wGAAwG,EAAE,GAAG,EAAE;QACjH,MAAM,MAAM,GAAG;YACd,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;gBACtB,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,SAAS;gBACxB,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,SAAS;aACjB;YACD,cAAc,EAAE,gBAAgB,CAAC,MAAM;SAClB,CAAC;QAEvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CACjB,mHAAmH,CACnH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;QAC1G,MAAM,MAAM,GAAG;YACd,SAAS,EAAE;gBACV,SAAS,EAAE,SAAS;gBACpB,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,SAAS;gBACxB,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,SAAS;aACjB;YACD,cAAc,EAAE,gBAAgB,CAAC,KAAK;SACjB,CAAC;QAEvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEhD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CACjB,6KAA6K,CAC7K,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mHAAmH,EAAE,GAAG,EAAE;QAC5H,MAAM,MAAM,GAAG;YACd,SAAS,EAAE;gBACV,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;gBACtB,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,SAAS;gBACxB,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,SAAS;aACjB;YACD,cAAc,EAAE,gBAAgB,CAAC,KAAK;SACjB,CAAC;QAEvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE/C,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CACjB,sLAAsL,CACtL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4FAA4F,EAAE,GAAG,EAAE;QACrG,MAAM,MAAM,GAAG;YACd,SAAS,EAAE;gBACV,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC;gBAC7B,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC;gBAC7B,OAAO,EAAE,SAAS;gBAClB,aAAa,EAAE,SAAS;gBACxB,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,SAAS;aACjB;YACD,cAAc,EAAE,gBAAgB,CAAC,KAAK;SACjB,CAAC;QAEvB,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE/C,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CACjB,uJAAuJ,CACvJ,CAAC;IACH,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/tests/redis/redisAccessRules.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=redisAccessRules.integration.test.d.ts.map

package/dist/tests/redis/redisAccessRules.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisAccessRules.integration.test.d.ts","sourceRoot":"","sources":["../../../src/tests/redis/redisAccessRules.integration.test.ts"],"names":[],"mappings":""}