@prosopo/user-access-policy 3.5.19 → 3.5.27

package/dist/redis/reader/redisAggregate.js

@@ -0,0 +1,60 @@
+import { z } from "zod";
+import { REDIS_QUERY_DIALECT } from "./redisRulesQuery.js";
+import { parseRedisRecords, REDIS_BATCH_SIZE } from "../redisClient.js";
+import { ACCESS_RULES_REDIS_INDEX_NAME } from "../redisRuleIndex.js";
+const aggregateRedisKeys = async (client, query, logger, batchHandler) => {
+  const keyField = "__key";
+  const recordSchema = z.object({
+    // it's a reserved name for the record key
+    [keyField]: z.string()
+  });
+  const foundKeys = [];
+  const addRecordKeys = async (records) => {
+    const parsedRecords = parseRedisRecords(records, recordSchema, logger);
+    const recordKeys = parsedRecords.map((record) => record[keyField]);
+    if (batchHandler) {
+      await batchHandler(recordKeys);
+    } else {
+      foundKeys.push(...recordKeys);
+      logger.debug(() => ({
+        msg: "Processed aggregation batch",
+        data: {
+          size: recordKeys.length
+        }
+      }));
+    }
+  };
+  await executeAggregation(
+    client,
+    query,
+    {
+      // #2 is a required option when the 'ismissing()' function is in the query body
+      DIALECT: REDIS_QUERY_DIALECT,
+      COUNT: REDIS_BATCH_SIZE,
+      LOAD: `@${keyField}`
+    },
+    addRecordKeys
+  );
+  return foundKeys;
+};
+const executeAggregation = async (client, query, aggregateOptions, handleBatch) => {
+  const initialReply = await client.ft.aggregateWithCursor(
+    ACCESS_RULES_REDIS_INDEX_NAME,
+    query,
+    aggregateOptions
+  );
+  await handleBatch(initialReply.results);
+  let cursor = initialReply.cursor;
+  while (0 !== cursor) {
+    const batchReply = await client.ft.cursorRead(
+      ACCESS_RULES_REDIS_INDEX_NAME,
+      cursor,
+      { COUNT: aggregateOptions.COUNT }
+    );
+    await handleBatch(batchReply.results);
+    cursor = batchReply.cursor;
+  }
+};
+export {
+  aggregateRedisKeys
+};

package/dist/redis/reader/redisAggregate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisAggregate.js","sourceRoot":"","sources":["../../../src/redis/reader/redisAggregate.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,yCAAyC,CAAC;AAC9E,OAAO,EACN,gBAAgB,EAChB,iBAAiB,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAC;AAGhF,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACtC,MAAuB,EACvB,KAAa,EACb,MAAc,EACd,YAAgD,EAC5B,EAAE;IACtB,MAAM,QAAQ,GAAG,OAAO,CAAC;IAEzB,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;QAE7B,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;KACtB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,MAAM,aAAa,GAAG,KAAK,EAAE,OAAiB,EAAE,EAAE;QACjD,MAAM,aAAa,GAAG,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;QAEvE,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAEnE,IAAI,YAAY,EAAE,CAAC;YAClB,MAAM,YAAY,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACP,SAAS,CAAC,IAAI,CAAC,GAAG,UAAU,CAAC,CAAC;YAE9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnB,GAAG,EAAE,6BAA6B;gBAClC,IAAI,EAAE;oBACL,IAAI,EAAE,UAAU,CAAC,MAAM;iBACvB;aACD,CAAC,CAAC,CAAC;QACL,CAAC;IACF,CAAC,CAAC;IAEF,MAAM,kBAAkB,CACvB,MAAM,EACN,KAAK,EACL;QAEC,OAAO,EAAE,mBAAmB;QAC5B,KAAK,EAAE,gBAAgB;QACvB,IAAI,EAAE,IAAI,QAAQ,EAAE;KACpB,EACD,aAAa,CACb,CAAC;IAEF,OAAO,SAAS,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,KAAK,EAC/B,MAAuB,EACvB,KAAa,EACb,gBAA8C,EAC9C,WAAiD,EACjC,EAAE;IAClB,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,mBAAmB,CACvD,6BAA6B,EAC7B,KAAK,EACL,gBAAgB,CAChB,CAAC;IAEF,MAAM,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAEjC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;QACrB,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,UAAU,CAC5C,6BAA6B,EAC7B,MAAM,EACN,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,EAAE,CACjC,CAAC;QAEF,MAAM,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAEtC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAC5B,CAAC;AACF,CAAC,CAAC"}

package/dist/redis/reader/redisRulesQuery.d.ts

@@ -0,0 +1,4 @@
+import { type AccessRulesFilter } from "#policy/rulesStorage.js";
+export declare const REDIS_QUERY_DIALECT = 2;
+export declare const getRulesRedisQuery: (filter: AccessRulesFilter, matchingFieldsOnly: boolean) => string;
+//# sourceMappingURL=redisRulesQuery.d.ts.map

package/dist/redis/reader/redisRulesQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesQuery.d.ts","sourceRoot":"","sources":["../../../src/redis/reader/redisRulesQuery.ts"],"names":[],"mappings":"AAgBA,OAAO,EACN,KAAK,iBAAiB,EAEtB,MAAM,yBAAyB,CAAC;AAKjC,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAmIrC,eAAO,MAAM,kBAAkB,WACtB,iBAAiB,sBACL,OAAO,KACzB,MA4BF,CAAC"}

package/dist/redis/reader/redisRulesQuery.js

@@ -0,0 +1,99 @@
+import { userScopeSchema } from "../../ruleInput/userScopeInput.js";
+import { FilterScopeMatch } from "../../rulesStorage.js";
+const REDIS_QUERY_DIALECT = 2;
+const userIpQueries = {
+  numericIp: (value, scope) => {
+    if (void 0 !== value) {
+      return `( @numericIp:[${value} ${value}] | ( @numericIpMaskMin:[-inf ${value}] @numericIpMaskMax:[${value} +inf] ) )`;
+    }
+    if (scope.numericIpMaskMin === void 0 && scope.numericIpMaskMax === void 0) {
+      return "ismissing(@numericIp) ismissing(@numericIpMaskMin) ismissing(@numericIpMaskMax)";
+    }
+    return "";
+  },
+  numericIpMaskMin: (value, scope) => {
+    if (scope.numericIp !== void 0) {
+      return "";
+    }
+    return value !== void 0 ? `@numericIpMaskMin:[-inf ${value}]` : "ismissing(@numericIpMaskMin)";
+  },
+  numericIpMaskMax: (value, scope) => {
+    if (scope.numericIp !== void 0) {
+      return "";
+    }
+    return value !== void 0 ? `@numericIpMaskMax:[${value} +inf]` : "ismissing(@numericIpMaskMax)";
+  }
+};
+const getUserScopeQuery = (userScope, FilterScopeMatchType, matchingFieldsOnly) => {
+  let scopeEntries = Object.entries(userScope);
+  let scopeJoinType = " ";
+  if (FilterScopeMatchType === FilterScopeMatch.Greedy) {
+    scopeEntries = scopeEntries.filter(
+      ([_, value]) => value !== void 0
+    );
+    scopeJoinType = " | ";
+  }
+  if (matchingFieldsOnly) {
+    const scopeMap = new Map(scopeEntries);
+    if (scopeMap.has("numericIp") && scopeMap.get("numericIp") === void 0) {
+      scopeMap.set("numericIpMaskMin", void 0);
+      scopeMap.set("numericIpMaskMax", void 0);
+    }
+    for (const name of Object.keys(userScopeSchema.shape)) {
+      if (!scopeMap.has(name)) {
+        scopeMap.set(name, void 0);
+      }
+    }
+    scopeEntries = [...scopeMap.entries()];
+  }
+  const scopeObj = Object.fromEntries(scopeEntries);
+  return scopeEntries.map(
+    ([scopeFieldName, scopeFieldValue]) => getUserScopeFieldQuery(
+      scopeFieldName,
+      scopeFieldValue,
+      FilterScopeMatchType,
+      scopeObj
+    )
+  ).filter(Boolean).join(scopeJoinType);
+};
+const getUserScopeFieldQuery = (fieldName, fieldValue, scopeMatch, fullScope) => {
+  if (fieldName in userIpQueries) {
+    const queryBuilder = userIpQueries[fieldName];
+    return queryBuilder(fieldValue, fullScope);
+  }
+  return void 0 === fieldValue ? `ismissing(@${fieldName})` : `@${fieldName}:{${fieldValue}}`;
+};
+const getPolicyScopeQuery = (policyScope, scopeMatch) => {
+  const clientId = policyScope?.clientId;
+  if ("string" === typeof clientId) {
+    return FilterScopeMatch.Exact === scopeMatch ? `@clientId:{${clientId}}` : `( @clientId:{${clientId}} | ismissing(@clientId) )`;
+  }
+  return FilterScopeMatch.Exact === scopeMatch ? "ismissing(@clientId)" : "";
+};
+const getRulesRedisQuery = (filter, matchingFieldsOnly) => {
+  const { policyScope, userScope } = filter;
+  const queryParts = [];
+  if (filter.groupId) {
+    queryParts.push(`@groupId:{${filter.groupId}}`);
+  }
+  const policyScopeQuery = getPolicyScopeQuery(
+    policyScope,
+    filter.policyScopeMatch
+  );
+  if (policyScopeQuery) {
+    queryParts.push(policyScopeQuery);
+  }
+  if (userScope && Object.keys(userScope).length > 0) {
+    const userScopeFilter = getUserScopeQuery(
+      userScope,
+      filter.userScopeMatch,
+      matchingFieldsOnly
+    );
+    queryParts.push(`( ${userScopeFilter} )`);
+  }
+  return queryParts.length > 0 ? queryParts.join(" ") : "*";
+};
+export {
+  REDIS_QUERY_DIALECT,
+  getRulesRedisQuery
+};

package/dist/redis/reader/redisRulesQuery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesQuery.js","sourceRoot":"","sources":["../../../src/redis/reader/redisRulesQuery.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAEN,gBAAgB,GAChB,MAAM,yBAAyB,CAAC;AAKjC,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,MAAM,aAAa,GAAuC;IACzD,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC3B,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACzB,OAAO,iBAAiB,KAAK,IAAI,KAAK,iCAAiC,KAAK,wBAAwB,KAAK,YAAY,CAAC;QACvH,CAAC;QAED,IACC,KAAK,CAAC,gBAAgB,KAAK,SAAS;YACpC,KAAK,CAAC,gBAAgB,KAAK,SAAS,EACnC,CAAC;YACF,OAAO,iFAAiF,CAAC;QAC1F,CAAC;QAED,OAAO,EAAE,CAAC;IACX,CAAC;IACD,gBAAgB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC,2BAA2B,KAAK,GAAG;YACrC,CAAC,CAAC,8BAA8B,CAAC;IACnC,CAAC;IACD,gBAAgB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAClC,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO,KAAK,KAAK,SAAS;YACzB,CAAC,CAAC,sBAAsB,KAAK,QAAQ;YACrC,CAAC,CAAC,8BAA8B,CAAC;IACnC,CAAC;CACD,CAAC;AAEF,MAAM,iBAAiB,GAAG,CACzB,SAAoB,EACpB,oBAAkD,EAClD,kBAA2B,EAClB,EAAE;IACX,IAAI,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAE1C,CAAC;IACF,IAAI,aAAa,GAAG,GAAG,CAAC;IAGxB,IAAI,oBAAoB,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACtD,YAAY,GAAG,YAAY,CAAC,MAAM,CACjC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CACE,CAAC;QACvC,aAAa,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,IAAI,kBAAkB,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAA2B,YAAY,CAAC,CAAC;QAGjE,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,SAAS,EAAE,CAAC;YAC1E,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;YAC5C,QAAQ,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAC7C,CAAC;QAGD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,KAAK,CAEnD,EAAE,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAC/B,CAAC;QACF,CAAC;QAED,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,YAAY,CAAuB,CAAC;IAExE,OAAO,YAAY;SACjB,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,EAAE,CAC1C,sBAAsB,CACrB,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,QAAQ,CACR,CACD;SACA,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,aAAa,CAAC,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC9B,SAA0B,EAC1B,UAAmB,EACnB,UAAwC,EACxC,SAA6B,EACpB,EAAE;IACX,IAAI,SAAS,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,YAAY,GAAG,aAAa,CAAC,SAAyB,CAAC,CAAC;QAE9D,OAAO,YAAY,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,SAAS,KAAK,UAAU;QAC9B,CAAC,CAAC,cAAc,SAAS,GAAG;QAC5B,CAAC,CAAC,IAAI,SAAS,KAAK,UAAU,GAAG,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAC3B,WAAoC,EACpC,UAAwC,EAC/B,EAAE;IACX,MAAM,QAAQ,GAAG,WAAW,EAAE,QAAQ,CAAC;IAEvC,IAAI,QAAQ,KAAK,OAAO,QAAQ,EAAE,CAAC;QAClC,OAAO,gBAAgB,CAAC,KAAK,KAAK,UAAU;YAC3C,CAAC,CAAC,cAAc,QAAQ,GAAG;YAC3B,CAAC,CAAC,gBAAgB,QAAQ,4BAA4B,CAAC;IACzD,CAAC;IAED,OAAO,gBAAgB,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC,CAAC;AAYF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CACjC,MAAyB,EACzB,kBAA2B,EAClB,EAAE;IACX,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,MAAM,CAAC;IAC1C,MAAM,UAAU,GAAG,EAAE,CAAC;IAEtB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,OAAO,GAAG,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,gBAAgB,GAAG,mBAAmB,CAC3C,WAAW,EACX,MAAM,CAAC,gBAAgB,CACvB,CAAC;IAEF,IAAI,gBAAgB,EAAE,CAAC;QACtB,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,eAAe,GAAG,iBAAiB,CACxC,SAAS,EACT,MAAM,CAAC,cAAc,EACrB,kBAAkB,CAClB,CAAC;QAEF,UAAU,CAAC,IAAI,CAAC,KAAK,eAAe,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC3D,CAAC,CAAC"}

package/dist/redis/reader/redisRulesReader.d.ts

@@ -0,0 +1,26 @@
+import { type Logger } from "@prosopo/common";
+import type { RedisClientType } from "redis";
+import type { AccessRule } from "#policy/rule.js";
+import type { AccessRuleEntry, AccessRulesFilter, AccessRulesReader } from "#policy/rulesStorage.js";
+export declare class RedisRulesReader implements AccessRulesReader {
+    private readonly client;
+    private readonly logger;
+    constructor(client: RedisClientType, logger: Logger);
+    getMissingRuleIds(ruleIds: string[]): Promise<string[]>;
+    fetchRules(ruleIds: string[]): Promise<AccessRuleEntry[]>;
+    findRules(filter: AccessRulesFilter, matchingFieldsOnly?: boolean, skipEmptyUserScopes?: boolean): Promise<AccessRule[]>;
+    findRuleIds(filter: AccessRulesFilter, matchingFieldsOnly?: boolean): Promise<string[]>;
+    fetchAllRuleIds(batchHandler: (ruleIds: string[]) => Promise<void>): Promise<void>;
+    protected fetchRuleEntries(keys: string[]): Promise<AccessRuleEntry[]>;
+    protected getRuleKeys(ruleIds: string[]): string[];
+}
+export declare class DummyRedisRulesReader implements AccessRulesReader {
+    private readonly logger;
+    constructor(logger: Logger);
+    getMissingRuleIds(ruleIds: string[]): Promise<string[]>;
+    fetchRules(ruleIds: string[]): Promise<AccessRuleEntry[]>;
+    findRules(filter: AccessRulesFilter, matchingFieldsOnly?: boolean, skipEmptyUserScopes?: boolean): Promise<AccessRule[]>;
+    findRuleIds(filter: AccessRulesFilter, matchingFieldsOnly?: boolean): Promise<string[]>;
+    fetchAllRuleIds(batchHandler: (ruleIds: string[]) => Promise<void>): Promise<void>;
+}
+//# sourceMappingURL=redisRulesReader.d.ts.map

package/dist/redis/reader/redisRulesReader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesReader.d.ts","sourceRoot":"","sources":["../../../src/redis/reader/redisRulesReader.ts"],"names":[],"mappings":"AAeA,OAAO,EACN,KAAK,MAAM,EAGX,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAe7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAElD,OAAO,KAAK,EACX,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,MAAM,yBAAyB,CAAC;AAGjC,qBAAa,gBAAiB,YAAW,iBAAiB;IAExD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,MAAM;IAG1B,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAcvD,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAazD,SAAS,CACd,MAAM,EAAE,iBAAiB,EACzB,kBAAkB,UAAQ,EAC1B,mBAAmB,UAAO,GACxB,OAAO,CAAC,UAAU,EAAE,CAAC;IAiElB,WAAW,CAChB,MAAM,EAAE,iBAAiB,EACzB,kBAAkB,UAAQ,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC;IAgDd,eAAe,CACpB,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAChD,OAAO,CAAC,IAAI,CAAC;cAYA,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IA8B5E,SAAS,CAAC,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE;CAGlD;AAED,qBAAa,qBAAsB,YAAW,iBAAiB;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAErC,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAWvD,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAWzD,SAAS,CACd,MAAM,EAAE,iBAAiB,EACzB,kBAAkB,UAAQ,EAC1B,mBAAmB,UAAO,GACxB,OAAO,CAAC,UAAU,EAAE,CAAC;IAWlB,WAAW,CAChB,MAAM,EAAE,iBAAiB,EACzB,kBAAkB,UAAQ,GACxB,OAAO,CAAC,MAAM,EAAE,CAAC;IAWd,eAAe,CACpB,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAChD,OAAO,CAAC,IAAI,CAAC;CAKhB"}

package/dist/redis/reader/redisRulesReader.js

@@ -0,0 +1,213 @@
+import * as util from "node:util";
+import { chunkIntoBatches, executeBatchesSequentially } from "@prosopo/common";
+import { getRulesRedisQuery, REDIS_QUERY_DIALECT } from "./redisRulesQuery.js";
+import { REDIS_BATCH_SIZE, getMissingRedisKeys, parseRedisRecords, fetchRedisHashRecords } from "../redisClient.js";
+import { ACCESS_RULE_REDIS_KEY_PREFIX, ACCESS_RULES_REDIS_INDEX_NAME } from "../redisRuleIndex.js";
+import { accessRuleInput } from "../../ruleInput/ruleInput.js";
+import { aggregateRedisKeys } from "./redisAggregate.js";
+class RedisRulesReader {
+  constructor(client, logger) {
+    this.client = client;
+    this.logger = logger;
+  }
+  async getMissingRuleIds(ruleIds) {
+    const ruleKeys = this.getRuleKeys(ruleIds);
+    const keyBatches = chunkIntoBatches(ruleKeys, REDIS_BATCH_SIZE);
+    const missingKeyBatches = await executeBatchesSequentially(
+      keyBatches,
+      async (keysBatch) => getMissingRedisKeys(this.client, keysBatch)
+    );
+    return missingKeyBatches.flat().map((ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length));
+  }
+  async fetchRules(ruleIds) {
+    const ruleKeys = this.getRuleKeys(ruleIds);
+    const keyBatches = chunkIntoBatches(ruleKeys, REDIS_BATCH_SIZE);
+    const entryBatches = await executeBatchesSequentially(
+      keyBatches,
+      (keysBatch) => this.fetchRuleEntries(keysBatch)
+    );
+    return entryBatches.flat();
+  }
+  async findRules(filter, matchingFieldsOnly = false, skipEmptyUserScopes = true) {
+    const query = getRulesRedisQuery(filter, matchingFieldsOnly);
+    if (skipEmptyUserScopes && query === "ismissing(@clientId)") {
+      return [];
+    }
+    let searchReply;
+    try {
+      searchReply = await this.client.ft.search(
+        ACCESS_RULES_REDIS_INDEX_NAME,
+        query,
+        {
+          DIALECT: REDIS_QUERY_DIALECT,
+          // FT.search doesn't support "unlimited" selects
+          LIMIT: {
+            from: 0,
+            size: REDIS_BATCH_SIZE
+          }
+        }
+      );
+      if (searchReply.total > 0) {
+        this.logger.debug(() => ({
+          msg: "Executed search query",
+          data: {
+            inspect: util.inspect(
+              {
+                filter,
+                searchReply,
+                query
+              },
+              { depth: null }
+            )
+          }
+        }));
+      }
+    } catch (e) {
+      this.logger.error(() => ({
+        err: e,
+        data: {
+          inspect: util.inspect(
+            {
+              query,
+              filter
+            },
+            {
+              depth: null
+            }
+          )
+        },
+        msg: "failed to execute search query"
+      }));
+      return [];
+    }
+    const records = searchReply.documents.map(({ value }) => value);
+    return parseRedisRecords(records, accessRuleInput, this.logger);
+  }
+  async findRuleIds(filter, matchingFieldsOnly = false) {
+    const query = getRulesRedisQuery(filter, matchingFieldsOnly);
+    let ruleIds = [];
+    try {
+      const ruleKeys = await aggregateRedisKeys(
+        this.client,
+        query,
+        this.logger
+      );
+      ruleIds = ruleKeys.map(
+        (ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length)
+      );
+    } catch (e) {
+      this.logger.error(() => ({
+        err: e,
+        data: {
+          inspect: util.inspect(
+            {
+              query,
+              filter
+            },
+            {
+              depth: null
+            }
+          )
+        },
+        msg: "Failed to execute search query for rule IDs"
+      }));
+      return [];
+    }
+    this.logger.debug(() => ({
+      msg: "Executed search query for rule IDs",
+      data: {
+        query,
+        foundCount: ruleIds.length,
+        foundIds: ruleIds
+      }
+    }));
+    return ruleIds;
+  }
+  async fetchAllRuleIds(batchHandler) {
+    const keysBatchHandler = async (keys) => {
+      const ids = keys.map(
+        (ruleKey) => ruleKey.slice(ACCESS_RULE_REDIS_KEY_PREFIX.length)
+      );
+      await batchHandler(ids);
+    };
+    await aggregateRedisKeys(this.client, "*", this.logger, keysBatchHandler);
+  }
+  async fetchRuleEntries(keys) {
+    const { records, expirations } = await fetchRedisHashRecords(
+      this.client,
+      keys,
+      this.logger
+    );
+    const entries = [];
+    for (const [index, ruleData] of records.entries()) {
+      const isRulePresent = Object.keys(ruleData).length > 0;
+      if (isRulePresent) {
+        const rule = parseRedisRecords(
+          [ruleData],
+          accessRuleInput,
+          this.logger
+        )[0];
+        if (rule) {
+          entries.push({
+            rule,
+            expiresUnixTimestamp: expirations[index]
+          });
+        }
+      }
+    }
+    return entries;
+  }
+  getRuleKeys(ruleIds) {
+    return ruleIds.map((id) => `${ACCESS_RULE_REDIS_KEY_PREFIX}${id}`);
+  }
+}
+class DummyRedisRulesReader {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  async getMissingRuleIds(ruleIds) {
+    this.logger.info(() => ({
+      msg: "Dummy getMissingRuleIds() has no effect (redis is not ready)",
+      data: {
+        ruleIds
+      }
+    }));
+    return [];
+  }
+  async fetchRules(ruleIds) {
+    this.logger.info(() => ({
+      msg: "Dummy fetchRule() has no effect (redis is not ready)",
+      data: {
+        ruleIds
+      }
+    }));
+    return [];
+  }
+  async findRules(filter, matchingFieldsOnly = false, skipEmptyUserScopes = true) {
+    this.logger.info(() => ({
+      msg: "Dummy findRules() has no effect (redis is not ready)",
+      data: {
+        filter
+      }
+    }));
+    return [];
+  }
+  async findRuleIds(filter, matchingFieldsOnly = false) {
+    this.logger.info(() => ({
+      msg: "Dummy findRuleIds() has no effect (redis is not ready)",
+      data: {
+        filter
+      }
+    }));
+    return [];
+  }
+  async fetchAllRuleIds(batchHandler) {
+    this.logger.info(() => ({
+      msg: "Dummy fetchAllRuleIds() has no effect (redis is not ready)"
+    }));
+  }
+}
+export {
+  DummyRedisRulesReader,
+  RedisRulesReader
+};

package/dist/redis/reader/redisRulesReader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesReader.js","sourceRoot":"","sources":["../../../src/redis/reader/redisRulesReader.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAEN,gBAAgB,EAChB,0BAA0B,GAC1B,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACN,mBAAmB,EACnB,kBAAkB,GAClB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,gBAAgB,EAChB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACN,6BAA6B,EAC7B,4BAA4B,GAC5B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAMjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,OAAO,gBAAgB;IAC5B,YACkB,MAAuB,EACvB,MAAc;QADd,WAAM,GAAN,MAAM,CAAiB;QACvB,WAAM,GAAN,MAAM,CAAQ;IAC7B,CAAC;IAEJ,KAAK,CAAC,iBAAiB,CAAC,OAAiB;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAEhE,MAAM,iBAAiB,GAAG,MAAM,0BAA0B,CACzD,UAAU,EACV,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAChE,CAAC;QAEF,OAAO,iBAAiB;aACtB,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC,CAAC;IACxE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAiB;QACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAE3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QAEhE,MAAM,YAAY,GAAG,MAAM,0BAA0B,CACpD,UAAU,EACV,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAC/C,CAAC;QAEF,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,SAAS,CACd,MAAyB,EACzB,kBAAkB,GAAG,KAAK,EAC1B,mBAAmB,GAAG,IAAI;QAE1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAE7D,IAAI,mBAAmB,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;YAE7D,OAAO,EAAE,CAAC;QACX,CAAC;QAED,IAAI,WAAwB,CAAC;QAE7B,IAAI,CAAC;YAEJ,WAAW,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CACxC,6BAA6B,EAC7B,KAAK,EACL;gBACC,OAAO,EAAE,mBAAmB;gBAE5B,KAAK,EAAE;oBACN,IAAI,EAAE,CAAC;oBACP,IAAI,EAAE,gBAAgB;iBACtB;aACD,CACD,CAAC;YAEF,IAAI,WAAW,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;oBACxB,GAAG,EAAE,uBAAuB;oBAC5B,IAAI,EAAE;wBACL,OAAO,EAAE,IAAI,CAAC,OAAO,CACpB;4BACC,MAAM,EAAE,MAAM;4BACd,WAAW,EAAE,WAAW;4BACxB,KAAK,EAAE,KAAK;yBACZ,EACD,EAAE,KAAK,EAAE,IAAI,EAAE,CACf;qBACD;iBACD,CAAC,CAAC,CAAC;YACL,CAAC;QACF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxB,GAAG,EAAE,CAAC;gBACN,IAAI,EAAE;oBACL,OAAO,EAAE,IAAI,CAAC,OAAO,CACpB;wBACC,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,MAAM;qBACd,EACD;wBACC,KAAK,EAAE,IAAI;qBACX,CACD;iBACD;gBACD,GAAG,EAAE,gCAAgC;aACrC,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,CAAC;QACX,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAEhE,OAAO,iBAAiB,CAAC,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,MAAyB,EACzB,kBAAkB,GAAG,KAAK;QAE1B,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;QAE7D,IAAI,OAAO,GAAa,EAAE,CAAC;QAE3B,IAAI,CAAC;YAEJ,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACxC,IAAI,CAAC,MAAM,EACX,KAAK,EACL,IAAI,CAAC,MAAM,CACX,CAAC;YAEF,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAClC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAClD,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACZ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACxB,GAAG,EAAE,CAAC;gBACN,IAAI,EAAE;oBACL,OAAO,EAAE,IAAI,CAAC,OAAO,CACpB;wBACC,KAAK,EAAE,KAAK;wBACZ,MAAM,EAAE,MAAM;qBACd,EACD;wBACC,KAAK,EAAE,IAAI;qBACX,CACD;iBACD;gBACD,GAAG,EAAE,6CAA6C;aAClD,CAAC,CAAC,CAAC;YAEJ,OAAO,EAAE,CAAC;QACX,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;YACxB,GAAG,EAAE,oCAAoC;YACzC,IAAI,EAAE;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,OAAO,CAAC,MAAM;gBAC1B,QAAQ,EAAE,OAAO;aACjB;SACD,CAAC,CAAC,CAAC;QAEJ,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,eAAe,CACpB,YAAkD;QAElD,MAAM,gBAAgB,GAAG,KAAK,EAAE,IAAc,EAAE,EAAE;YACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAChC,OAAO,CAAC,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAClD,CAAC;YAEF,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC,CAAC;QAEF,MAAM,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3E,CAAC;IAES,KAAK,CAAC,gBAAgB,CAAC,IAAc;QAC9C,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,qBAAqB,CAC3D,IAAI,CAAC,MAAM,EACX,IAAI,EACJ,IAAI,CAAC,MAAM,CACX,CAAC;QACF,MAAM,OAAO,GAAsB,EAAE,CAAC;QAEtC,KAAK,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;YACnD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAEvD,IAAI,aAAa,EAAE,CAAC;gBACnB,MAAM,IAAI,GAAG,iBAAiB,CAC7B,CAAC,QAAQ,CAAC,EACV,eAAe,EACf,IAAI,CAAC,MAAM,CACX,CAAC,CAAC,CAAC,CAAC;gBAEL,IAAI,IAAI,EAAE,CAAC;oBACV,OAAO,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,IAAI;wBACV,oBAAoB,EAAE,WAAW,CAAC,KAAK,CAAC;qBACxC,CAAC,CAAC;gBACJ,CAAC;YACF,CAAC;QACF,CAAC;QAED,OAAO,OAAO,CAAC;IAChB,CAAC;IAES,WAAW,CAAC,OAAiB;QACtC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,4BAA4B,GAAG,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC;CACD;AAED,MAAM,OAAO,qBAAqB;IACjC,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,KAAK,CAAC,iBAAiB,CAAC,OAAiB;QACxC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,8DAA8D;YACnE,IAAI,EAAE;gBACL,OAAO;aACP;SACD,CAAC,CAAC,CAAC;QAEJ,OAAO,EAAE,CAAC;IACX,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,OAAiB;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,sDAAsD;YAC3D,IAAI,EAAE;gBACL,OAAO;aACP;SACD,CAAC,CAAC,CAAC;QAEJ,OAAO,EAAE,CAAC;IACX,CAAC;IAED,KAAK,CAAC,SAAS,CACd,MAAyB,EACzB,kBAAkB,GAAG,KAAK,EAC1B,mBAAmB,GAAG,IAAI;QAE1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,sDAAsD;YAC3D,IAAI,EAAE;gBACL,MAAM;aACN;SACD,CAAC,CAAC,CAAC;QAEJ,OAAO,EAAE,CAAC;IACX,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,MAAyB,EACzB,kBAAkB,GAAG,KAAK;QAE1B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,wDAAwD;YAC7D,IAAI,EAAE;gBACL,MAAM;aACN;SACD,CAAC,CAAC,CAAC;QAEJ,OAAO,EAAE,CAAC;IACX,CAAC;IAED,KAAK,CAAC,eAAe,CACpB,YAAkD;QAElD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACvB,GAAG,EAAE,4DAA4D;SACjE,CAAC,CAAC,CAAC;IACL,CAAC;CACD"}

package/dist/redis/redisAccessRules.d.ts

@@ -0,0 +1,7 @@
+import type { Logger } from "@prosopo/common";
+import type { RedisClientType } from "redis";
+import { type AccessRulesReader, type AccessRulesStorage, type AccessRulesWriter } from "#policy/accessRules.js";
+export declare const createRedisAccessRulesReader: (client: RedisClientType, logger: Logger) => AccessRulesReader;
+export declare const createRedisAccessRulesWriter: (client: RedisClientType) => AccessRulesWriter;
+export declare const createRedisAccessRulesStorage: (client: RedisClientType, logger: Logger) => AccessRulesStorage;
+//# sourceMappingURL=redisAccessRules.d.ts.map

package/dist/redis/redisAccessRules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisAccessRules.d.ts","sourceRoot":"","sources":["../../src/redis/redisAccessRules.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAG9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAE7C,OAAO,EAEN,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EAEtB,MAAM,wBAAwB,CAAC;AAUhC,eAAO,MAAM,4BAA4B,WAChC,eAAe,UACf,MAAM,KACZ,iBAmGF,CAAC;AAEF,eAAO,MAAM,4BAA4B,WAChC,eAAe,KACrB,iBAoCF,CAAC;AAEF,eAAO,MAAM,6BAA6B,WACjC,eAAe,UACf,MAAM,KACZ,kBAKF,CAAC"}

package/dist/redis/redisAccessRules.js

@@ -0,0 +1,119 @@
+import * as util from "node:util";
+import { accessRuleSchema, } from "#policy/accessRules.js";
+import { accessRuleRedisKeyPrefix, accessRulesRedisIndexName, accessRulesRedisSearchOptions, getRedisAccessRuleKey, getRedisAccessRuleValue, getRedisAccessRulesQuery, } from "#policy/redis/redisAccessRulesIndex.js";
+export const createRedisAccessRulesReader = (client, logger) => {
+    return {
+        findRules: async (filter, matchingFieldsOnly = false, skipEmptyUserScopes = true) => {
+            const query = getRedisAccessRulesQuery(filter, matchingFieldsOnly);
+            if (skipEmptyUserScopes && query === "ismissing(@clientId)") {
+                return [];
+            }
+            let searchReply;
+            try {
+                searchReply = await client.ft.search(accessRulesRedisIndexName, query, accessRulesRedisSearchOptions);
+                if (searchReply.total > 0) {
+                    logger.debug(() => ({
+                        msg: "Executed search query",
+                        data: {
+                            inspect: util.inspect({
+                                filter: filter,
+                                searchReply: searchReply,
+                                query: query,
+                            }, { depth: null }),
+                        },
+                    }));
+                }
+            }
+            catch (e) {
+                logger.error(() => ({
+                    err: e,
+                    data: {
+                        inspect: util.inspect({
+                            query: query,
+                            filter: filter,
+                        }, {
+                            depth: null,
+                        }),
+                    },
+                    msg: "failed to execute search query",
+                }));
+                return [];
+            }
+            return extractAccessRulesFromSearchReply(searchReply, logger);
+        },
+        findRuleIds: async (filter, matchingFieldsOnly = false) => {
+            const query = getRedisAccessRulesQuery(filter, matchingFieldsOnly);
+            let searchReply;
+            try {
+                searchReply = await client.ft.searchNoContent(accessRulesRedisIndexName, query, accessRulesRedisSearchOptions);
+            }
+            catch (e) {
+                logger.error(() => ({
+                    err: e,
+                    data: {
+                        inspect: util.inspect({
+                            query: query,
+                            filter: filter,
+                        }, {
+                            depth: null,
+                        }),
+                    },
+                    msg: "Failed to execute search query for rule IDs",
+                }));
+                return [];
+            }
+            return searchReply.documents;
+        },
+    };
+};
+export const createRedisAccessRulesWriter = (client) => {
+    return {
+        insertRule: async (rule, expirationTimestamp) => {
+            const ruleKey = getRedisAccessRuleKey(rule);
+            const ruleValue = getRedisAccessRuleValue(rule);
+            await client.hSet(ruleKey, ruleValue);
+            if (expirationTimestamp) {
+                const expiryDate = new Date(expirationTimestamp);
+                if (expiryDate.getUTCFullYear() === 1970) {
+                    await client.expireAt(ruleKey, expirationTimestamp);
+                }
+                else {
+                    const timestampInSeconds = Math.floor(expirationTimestamp / 1000);
+                    await client.expireAt(ruleKey, timestampInSeconds);
+                }
+            }
+            return ruleKey;
+        },
+        deleteRules: async (ruleIds) => void (await client.del(ruleIds)),
+        deleteAllRules: async () => {
+            const keys = await client.keys(`${accessRuleRedisKeyPrefix}*`);
+            if (keys.length === 0)
+                return 0;
+            return await client.del(keys);
+        },
+    };
+};
+export const createRedisAccessRulesStorage = (client, logger) => {
+    return {
+        ...createRedisAccessRulesReader(client, logger),
+        ...createRedisAccessRulesWriter(client),
+    };
+};
+const extractAccessRulesFromSearchReply = (searchReply, logger) => {
+    const accessRules = [];
+    searchReply.documents.map(({ id, value: document }) => {
+        const parsedDocument = accessRuleSchema.safeParse(document);
+        if (parsedDocument.success) {
+            accessRules.push(parsedDocument.data);
+        }
+        else {
+            logger.debug(() => ({
+                msg: "Failed to parse access rule from search reply",
+                id: id,
+                error: parsedDocument.error,
+            }));
+        }
+    });
+    return accessRules;
+};
+//# sourceMappingURL=redisAccessRules.js.map

package/dist/redis/redisAccessRules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisAccessRules.js","sourceRoot":"","sources":["../../src/redis/redisAccessRules.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAMlC,OAAO,EAKN,gBAAgB,GAChB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,6BAA6B,EAC7B,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,GACxB,MAAM,wCAAwC,CAAC;AAEhD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC3C,MAAuB,EACvB,MAAc,EACM,EAAE;IACtB,OAAO;QACN,SAAS,EAAE,KAAK,EACf,MAAoB,EACpB,kBAAkB,GAAG,KAAK,EAC1B,mBAAmB,GAAG,IAAI,EACF,EAAE;YAC1B,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAEnE,IAAI,mBAAmB,IAAI,KAAK,KAAK,sBAAsB,EAAE,CAAC;gBAE7D,OAAO,EAAE,CAAC;YACX,CAAC;YAED,IAAI,WAAwB,CAAC;YAE7B,IAAI,CAAC;gBACJ,WAAW,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,MAAM,CACnC,yBAAyB,EACzB,KAAK,EACL,6BAA6B,CAC7B,CAAC;gBAEF,IAAI,WAAW,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;oBAC3B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;wBACnB,GAAG,EAAE,uBAAuB;wBAC5B,IAAI,EAAE;4BACL,OAAO,EAAE,IAAI,CAAC,OAAO,CACpB;gCACC,MAAM,EAAE,MAAM;gCACd,WAAW,EAAE,WAAW;gCACxB,KAAK,EAAE,KAAK;6BACZ,EACD,EAAE,KAAK,EAAE,IAAI,EAAE,CACf;yBACD;qBACD,CAAC,CAAC,CAAC;gBACL,CAAC;YACF,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACZ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;oBACnB,GAAG,EAAE,CAAC;oBACN,IAAI,EAAE;wBACL,OAAO,EAAE,IAAI,CAAC,OAAO,CACpB;4BACC,KAAK,EAAE,KAAK;4BACZ,MAAM,EAAE,MAAM;yBACd,EACD;4BACC,KAAK,EAAE,IAAI;yBACX,CACD;qBACD;oBACD,GAAG,EAAE,gCAAgC;iBACrC,CAAC,CAAC,CAAC;gBAEJ,OAAO,EAAE,CAAC;YACX,CAAC;YAED,OAAO,iCAAiC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,CAAC;QAED,WAAW,EAAE,KAAK,EACjB,MAAoB,EACpB,kBAAkB,GAAG,KAAK,EACN,EAAE;YACtB,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;YAEnE,IAAI,WAAiC,CAAC;YAEtC,IAAI,CAAC;gBACJ,WAAW,GAAG,MAAM,MAAM,CAAC,EAAE,CAAC,eAAe,CAC5C,yBAAyB,EACzB,KAAK,EACL,6BAA6B,CAC7B,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBAEZ,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;oBACnB,GAAG,EAAE,CAAC;oBACN,IAAI,EAAE;wBACL,OAAO,EAAE,IAAI,CAAC,OAAO,CACpB;4BACC,KAAK,EAAE,KAAK;4BACZ,MAAM,EAAE,MAAM;yBACd,EACD;4BACC,KAAK,EAAE,IAAI;yBACX,CACD;qBACD;oBACD,GAAG,EAAE,6CAA6C;iBAClD,CAAC,CAAC,CAAC;gBAEJ,OAAO,EAAE,CAAC;YACX,CAAC;YAED,OAAO,WAAW,CAAC,SAAS,CAAC;QAC9B,CAAC;KACD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC3C,MAAuB,EACH,EAAE;IACtB,OAAO;QACN,UAAU,EAAE,KAAK,EAChB,IAAgB,EAChB,mBAA4B,EACV,EAAE;YACpB,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAEhD,MAAM,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAEtC,IAAI,mBAAmB,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,mBAAmB,CAAC,CAAC;gBACjD,IAAI,UAAU,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC;oBAE1C,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACP,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;oBAClE,MAAM,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;gBACpD,CAAC;YACF,CAAC;YAED,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,WAAW,EAAE,KAAK,EAAE,OAAiB,EAAiB,EAAE,CACvD,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAEjC,cAAc,EAAE,KAAK,IAAqB,EAAE;YAC3C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,GAAG,wBAAwB,GAAG,CAAC,CAAC;YAE/D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;YAEhC,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;KACD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC5C,MAAuB,EACvB,MAAc,EACO,EAAE;IACvB,OAAO;QACN,GAAG,4BAA4B,CAAC,MAAM,EAAE,MAAM,CAAC;QAC/C,GAAG,4BAA4B,CAAC,MAAM,CAAC;KACvC,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,iCAAiC,GAAG,CACzC,WAAwB,EACxB,MAAc,EACC,EAAE;IACjB,MAAM,WAAW,GAAiB,EAAE,CAAC;IAErC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrD,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAE5D,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;YAC5B,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;aAAM,CAAC;YACP,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;gBACnB,GAAG,EAAE,+CAA+C;gBACpD,EAAE,EAAE,EAAE;gBACN,KAAK,EAAE,cAAc,CAAC,KAAK;aAC3B,CAAC,CAAC,CAAC;QACL,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,OAAO,WAAW,CAAC;AACpB,CAAC,CAAC"}

package/dist/redis/redisAccessRulesIndex.d.ts

@@ -0,0 +1,13 @@
+import { type FtSearchOptions } from "@redis/search";
+import type { RedisClientType } from "redis";
+import { type PolicyFilter } from "#policy/accessPolicyResolver.js";
+import type { AccessRule } from "#policy/accessRules.js";
+export declare const accessRulesRedisIndexName = "index:user-access-rules";
+export declare const accessRuleRedisKeyPrefix = "uar:";
+export declare const createRedisAccessRulesIndex: (client: RedisClientType, indexName?: string) => Promise<void>;
+export declare const accessRulesRedisSearchOptions: FtSearchOptions;
+export declare const accessRulesRedisDeleteOptions: FtSearchOptions;
+export declare const getRedisAccessRulesQuery: (filter: PolicyFilter, matchingFieldsOnly: boolean) => string;
+export declare const getRedisAccessRuleKey: (rule: AccessRule) => string;
+export declare const getRedisAccessRuleValue: (rule: AccessRule) => Record<string, string>;
+//# sourceMappingURL=redisAccessRulesIndex.d.ts.map

package/dist/redis/redisAccessRulesIndex.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisAccessRulesIndex.d.ts","sourceRoot":"","sources":["../../src/redis/redisAccessRulesIndex.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,KAAK,eAAe,EAAqB,MAAM,eAAe,CAAC;AACxE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAM7C,OAAO,EAAE,KAAK,YAAY,EAAc,MAAM,iCAAiC,CAAC;AAChF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAGzD,eAAO,MAAM,yBAAyB,4BAA4B,CAAC;AAEnE,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAmC/C,eAAO,MAAM,2BAA2B,WAC/B,eAAe,cACX,MAAM,KAChB,OAAO,CAAC,IAAI,CAKd,CAAC;AA8CF,eAAO,MAAM,6BAA6B,EAAE,eAG3C,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,eAO3C,CAAC;AAYF,eAAO,MAAM,wBAAwB,WAC5B,YAAY,sBACA,OAAO,KACzB,MAkBF,CAAC;AA0FF,eAAO,MAAM,qBAAqB,SAAU,UAAU,KAAG,MAUzC,CAAC;AAEjB,eAAO,MAAM,uBAAuB,SAC7B,UAAU,KACd,MAAM,CAAC,MAAM,EAAE,MAAM,CAGtB,CAAC"}