@prosopo/user-access-policy 3.5.19 → 3.5.28

package/dist/cjs/redis/redisRuleIndex.cjs

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const search = require("@redis/search");
+const transformRule = require("../transformRule.cjs");
+const userIpRedisSchema = {
+  numericIpMaskMin: { type: search.SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+  numericIpMaskMax: { type: search.SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true },
+  numericIp: { type: search.SCHEMA_FIELD_TYPE.NUMERIC, INDEXMISSING: true }
+};
+const userAttributesRedisSchema = {
+  userId: { type: search.SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+  ja4Hash: { type: search.SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+  headersHash: { type: search.SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true },
+  userAgentHash: { type: search.SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true }
+};
+const userScopeRedisSchema = {
+  ...userAttributesRedisSchema,
+  ...userIpRedisSchema
+};
+const policyScopeRedisSchema = {
+  clientId: {
+    type: search.SCHEMA_FIELD_TYPE.TAG,
+    INDEXMISSING: true
+  }
+};
+const accessRuleRedisSchema = {
+  ...policyScopeRedisSchema,
+  ...userScopeRedisSchema,
+  groupId: { type: search.SCHEMA_FIELD_TYPE.TAG, INDEXMISSING: true }
+};
+const ACCESS_RULES_REDIS_INDEX_NAME = "index:user-access-rules";
+const ACCESS_RULE_REDIS_KEY_PREFIX = "uar:";
+const accessRulesRedisIndex = {
+  name: ACCESS_RULES_REDIS_INDEX_NAME,
+  schema: accessRuleRedisSchema,
+  options: {
+    ON: "HASH",
+    PREFIX: [ACCESS_RULE_REDIS_KEY_PREFIX]
+  }
+};
+const getAccessRuleRedisKey = (rule) => ACCESS_RULE_REDIS_KEY_PREFIX + transformRule.makeAccessRuleHash(rule);
+exports.ACCESS_RULES_REDIS_INDEX_NAME = ACCESS_RULES_REDIS_INDEX_NAME;
+exports.ACCESS_RULE_REDIS_KEY_PREFIX = ACCESS_RULE_REDIS_KEY_PREFIX;
+exports.accessRuleRedisSchema = accessRuleRedisSchema;
+exports.accessRulesRedisIndex = accessRulesRedisIndex;
+exports.getAccessRuleRedisKey = getAccessRuleRedisKey;
+exports.policyScopeRedisSchema = policyScopeRedisSchema;
+exports.userAttributesRedisSchema = userAttributesRedisSchema;
+exports.userIpRedisSchema = userIpRedisSchema;
+exports.userScopeRedisSchema = userScopeRedisSchema;

package/dist/cjs/redis/redisRulesStorage.cjs

@@ -1,21 +1,34 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const redisRulesReader = require("./redisRulesReader.cjs");
+const redisRulesReader = require("./reader/redisRulesReader.cjs");
 const redisRulesWriter = require("./redisRulesWriter.cjs");
 const createRedisAccessRulesStorage = (connection, logger) => {
-  const storage = {
-    ...redisRulesReader.getDummyRedisRulesReader(logger),
-    ...redisRulesWriter.getDummyRedisRulesWriter(logger)
-  };
+  const storage = composeStorage(
+    new redisRulesReader.DummyRedisRulesReader(logger),
+    new redisRulesWriter.DummyRedisRulesWriter(logger)
+  );
   connection.getClient().then((client) => {
-    Object.assign(storage, {
-      ...redisRulesReader.createRedisRulesReader(client, logger),
-      ...redisRulesWriter.createRedisRulesWriter(client)
-    });
+    const realStorage = composeStorage(
+      new redisRulesReader.RedisRulesReader(client, logger),
+      new redisRulesWriter.RedisRulesWriter(client, logger)
+    );
+    Object.assign(storage, realStorage);
     logger.info(() => ({
       msg: "RedisAccessRules storage got a ready Redis client"
     }));
   });
   return storage;
 };
+const composeStorage = (reader, writer) => ({
+  // reader
+  fetchRules: reader.fetchRules.bind(reader),
+  getMissingRuleIds: reader.getMissingRuleIds.bind(reader),
+  findRules: reader.findRules.bind(reader),
+  findRuleIds: reader.findRuleIds.bind(reader),
+  fetchAllRuleIds: reader.fetchAllRuleIds.bind(reader),
+  // writer
+  insertRules: writer.insertRules.bind(writer),
+  deleteRules: writer.deleteRules.bind(writer),
+  deleteAllRules: writer.deleteAllRules.bind(writer)
+});
 exports.createRedisAccessRulesStorage = createRedisAccessRulesStorage;

package/dist/cjs/redis/redisRulesWriter.cjs

@@ -1,73 +1,100 @@
 "use strict";
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const crypto = require("node:crypto");
-const redisRulesIndex = require("./redisRulesIndex.cjs");
-const redisRuleContentHashAlgorithm = "md5";
-const createRedisRulesWriter = (client) => {
-  return {
-    insertRule: async (rule, expirationTimestamp) => {
-      const ruleKey = getRedisRuleKey(rule);
+const common = require("@prosopo/common");
+const redisClient = require("./redisClient.cjs");
+const redisRuleIndex = require("./redisRuleIndex.cjs");
+class RedisRulesWriter {
+  constructor(client, logger) {
+    this.client = client;
+    this.logger = logger;
+  }
+  async insertRules(ruleEntries) {
+    const entryBatches = common.chunkIntoBatches(ruleEntries, redisClient.REDIS_BATCH_SIZE);
+    const keyBatches = await common.executeBatchesSequentially(
+      entryBatches,
+      async (entriesBatch) => this.insertRuleEntries(entriesBatch)
+    );
+    return keyBatches.flatMap(
+      (ruleKey) => ruleKey.slice(redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX.length)
+    );
+  }
+  async deleteRules(ruleIds) {
+    const ruleKeys = ruleIds.map(
+      (ruleId) => redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX + ruleId
+    );
+    const keyBatches = common.chunkIntoBatches(ruleKeys, redisClient.REDIS_BATCH_SIZE);
+    await common.executeBatchesSequentially(keyBatches, async (keysBatch) => {
+      const queries = this.client.multi();
+      for (const ruleKey of keysBatch) {
+        queries.del(ruleKey);
+      }
+      await queries.exec();
+    });
+  }
+  async deleteAllRules() {
+    let cursor = "0";
+    let total = 0;
+    do {
+      const reply = await this.client.scan(cursor, {
+        MATCH: `${redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX}*`,
+        COUNT: redisClient.REDIS_BATCH_SIZE
+      });
+      const ids = reply.keys.map(
+        (key) => key.slice(redisRuleIndex.ACCESS_RULE_REDIS_KEY_PREFIX.length)
+      );
+      await this.deleteRules(ids);
+      total += ids.length;
+      cursor = reply.cursor;
+    } while ("0" !== cursor);
+    return total;
+  }
+  async insertRuleEntries(ruleEntries) {
+    const queries = this.client.multi();
+    const ruleKeys = ruleEntries.map((ruleEntry) => {
+      const { rule, expiresUnixTimestamp } = ruleEntry;
+      const ruleKey = redisRuleIndex.getAccessRuleRedisKey(rule);
       const ruleValue = getRedisRuleValue(rule);
-      await client.hSet(ruleKey, ruleValue);
-      if (expirationTimestamp) {
-        const expiryDate = new Date(expirationTimestamp);
-        if (expiryDate.getUTCFullYear() === 1970) {
-          await client.expireAt(ruleKey, expirationTimestamp);
-        } else {
-          const timestampInSeconds = Math.floor(expirationTimestamp / 1e3);
-          await client.expireAt(ruleKey, timestampInSeconds);
-        }
+      queries.hSet(ruleKey, ruleValue);
+      if (expiresUnixTimestamp) {
+        queries.expireAt(ruleKey, expiresUnixTimestamp);
       }
       return ruleKey;
-    },
-    deleteRules: async (ruleIds) => void await client.del(ruleIds),
-    deleteAllRules: async () => {
-      const keys = await client.keys(`${redisRulesIndex.redisRuleKeyPrefix}*`);
-      if (keys.length === 0) return 0;
-      return await client.del(keys);
-    }
-  };
-};
-const getDummyRedisRulesWriter = (logger) => {
-  return {
-    insertRule: async (rule, expirationTimestamp) => {
-      logger.info(() => ({
-        msg: "Dummy insertRule() has no effect (redis is not ready)",
-        data: {
-          rule
-        }
-      }));
-      return "";
-    },
-    deleteRules: async (ruleIds) => {
-      logger.info(() => ({
-        msg: "Dummy deleteRules() has no effect (redis is not ready)",
-        data: {
-          ruleIds
-        }
-      }));
-    },
-    deleteAllRules: async () => {
-      logger.info(() => ({
-        msg: "Dummy deleteAllRules() has no effect (redis is not ready)"
-      }));
-      return 0;
-    }
-  };
-};
-const getRedisRuleKey = (rule) => redisRulesIndex.redisRuleKeyPrefix + crypto.createHash(redisRuleContentHashAlgorithm).update(
-  JSON.stringify(
-    rule,
-    (key, value) => (
-      // JSON.stringify can't handle BigInt itself: throws "Do not know how to serialize a BigInt"
-      "bigint" === typeof value ? value.toString() : value
-    )
-  )
-).digest("hex");
+    });
+    await queries.exec();
+    return ruleKeys;
+  }
+}
 const getRedisRuleValue = (rule) => Object.fromEntries(
   Object.entries(rule).map(([key, value]) => [key, String(value)])
 );
-exports.createRedisRulesWriter = createRedisRulesWriter;
-exports.getDummyRedisRulesWriter = getDummyRedisRulesWriter;
-exports.getRedisRuleKey = getRedisRuleKey;
+class DummyRedisRulesWriter {
+  constructor(logger) {
+    this.logger = logger;
+  }
+  async insertRules(ruleEntries) {
+    this.logger.info(() => ({
+      msg: "Dummy insertRules() has no effect (redis is not ready)",
+      data: {
+        ruleEntries
+      }
+    }));
+    return [];
+  }
+  async deleteRules(ruleIds) {
+    this.logger.info(() => ({
+      msg: "Dummy deleteRules() has no effect (redis is not ready)",
+      data: {
+        ruleIds
+      }
+    }));
+  }
+  async deleteAllRules() {
+    this.logger.info(() => ({
+      msg: "Dummy deleteAllRules() has no effect (redis is not ready)"
+    }));
+    return 0;
+  }
+}
+exports.DummyRedisRulesWriter = DummyRedisRulesWriter;
+exports.RedisRulesWriter = RedisRulesWriter;
 exports.getRedisRuleValue = getRedisRuleValue;

package/dist/cjs/rule.cjs

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+var AccessPolicyType = /* @__PURE__ */ ((AccessPolicyType2) => {
+  AccessPolicyType2["Block"] = "block";
+  AccessPolicyType2["Restrict"] = "restrict";
+  return AccessPolicyType2;
+})(AccessPolicyType || {});
+exports.AccessPolicyType = AccessPolicyType;

package/dist/cjs/ruleInput/.export.cjs

@@ -0,0 +1,9 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const ruleInput = require("./ruleInput.cjs");
+const policyInput = require("./policyInput.cjs");
+const userScopeInput = require("./userScopeInput.cjs");
+exports.accessRuleInput = ruleInput.accessRuleInput;
+exports.accessPolicyInput = policyInput.accessPolicyInput;
+exports.policyScopeInput = policyInput.policyScopeInput;
+exports.userScopeInput = userScopeInput.userScopeInput;

package/dist/cjs/ruleInput/policyInput.cjs

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const types = require("@prosopo/types");
+const zod = require("zod");
+const rule = require("../rule.cjs");
+const accessPolicyInput = zod.z.object({
+  type: zod.z.nativeEnum(rule.AccessPolicyType),
+  captchaType: types.CaptchaTypeSchema.optional(),
+  description: zod.z.coerce.string().optional(),
+  // Redis stores values as strings, so coerce is needed to parse properly
+  solvedImagesCount: zod.z.coerce.number().optional(),
+  // the percentage of image panels that must be solved per image CAPTCHA
+  imageThreshold: zod.z.coerce.number().optional(),
+  // the Proof-of-Work difficulty level
+  powDifficulty: zod.z.coerce.number().optional(),
+  // the number of unsolved image CAPTCHA challenges to serve
+  unsolvedImagesCount: zod.z.coerce.number().optional(),
+  // used to increase the user's score
+  frictionlessScore: zod.z.coerce.number().optional()
+});
+const policyScopeInput = zod.z.object({
+  clientId: zod.z.coerce.string().optional()
+});
+exports.accessPolicyInput = accessPolicyInput;
+exports.policyScopeInput = policyScopeInput;

package/dist/cjs/ruleInput/ruleInput.cjs

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const zod = require("zod");
+const rulesStorage = require("../rulesStorage.cjs");
+const policyInput = require("./policyInput.cjs");
+const userScopeInput = require("./userScopeInput.cjs");
+const ruleGroupInput = zod.z.object({
+  groupId: zod.z.coerce.string().optional(),
+  ruleGroupId: zod.z.coerce.string().optional()
+}).transform((ruleGroupInput2) => {
+  const { ruleGroupId, ...ruleGroup } = ruleGroupInput2;
+  if ("string" === typeof ruleGroupId) {
+    ruleGroup.groupId = ruleGroupId;
+  }
+  return ruleGroup;
+});
+const accessRuleInput = zod.z.object({
+  ...policyInput.accessPolicyInput.shape,
+  ...policyInput.policyScopeInput.shape
+}).and(userScopeInput.userScopeInput).and(ruleGroupInput).transform((ruleInput) => ruleInput);
+const ruleEntryInput = zod.z.object({
+  rule: accessRuleInput,
+  expiresUnixTimestamp: zod.z.coerce.number().optional()
+});
+const accessRulesFilterInput = zod.z.object({
+  policyScope: policyInput.policyScopeInput.optional(),
+  policyScopes: zod.z.array(policyInput.policyScopeInput).optional(),
+  policyScopeMatch: zod.z.nativeEnum(rulesStorage.FilterScopeMatch).default(rulesStorage.FilterScopeMatch.Exact),
+  userScope: userScopeInput.userScopeInput.optional(),
+  userScopeMatch: zod.z.nativeEnum(rulesStorage.FilterScopeMatch).default(rulesStorage.FilterScopeMatch.Exact),
+  groupId: zod.z.string().optional()
+});
+const getAccessRuleFiltersFromInput = (filterInput) => {
+  const { policyScopes, policyScope, ...filterBase } = filterInput;
+  const allPolicyScopes = policyScopes || [];
+  if (policyScope) {
+    allPolicyScopes.push(policyScope);
+  }
+  if (allPolicyScopes.length > 0) {
+    return allPolicyScopes.map((policyScope2) => ({
+      ...filterBase,
+      policyScope: policyScope2
+    }));
+  }
+  return [filterBase];
+};
+exports.accessRuleInput = accessRuleInput;
+exports.accessRulesFilterInput = accessRulesFilterInput;
+exports.getAccessRuleFiltersFromInput = getAccessRuleFiltersFromInput;
+exports.ruleEntryInput = ruleEntryInput;

package/dist/cjs/ruleInput/userScopeInput.cjs

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const crypto = require("node:crypto");
+const util = require("@prosopo/util");
+const ipAddress = require("ip-address");
+const zod = require("zod");
+const userAttributesSchema = zod.z.object({
+  // coerce is used for safety, as e.g., incoming userId can be digital
+  userId: zod.z.coerce.string().optional(),
+  ja4Hash: zod.z.coerce.string().optional(),
+  headersHash: zod.z.coerce.string().optional(),
+  userAgentHash: zod.z.coerce.string().optional()
+});
+const userAttributesInput = zod.z.object({
+  ...userAttributesSchema.shape,
+  userAgent: zod.z.coerce.string().optional()
+}).transform((userAttributesInput2) => {
+  const { userAgent, ...userScope } = userAttributesInput2;
+  if ("string" === typeof userAgent) {
+    userScope.userAgentHash = hashUserAgent(userAgent);
+  }
+  return userScope;
+});
+const hashUserAgent = (userAgent) => crypto.createHash("sha256").update(userAgent).digest("hex");
+const userIpSchema = zod.z.object({
+  numericIp: zod.z.coerce.bigint().optional(),
+  numericIpMaskMin: zod.z.coerce.bigint().optional(),
+  numericIpMaskMax: zod.z.coerce.bigint().optional()
+});
+const userIpInput = zod.z.object({
+  ...userIpSchema.shape,
+  ip: zod.z.string().optional(),
+  ipMask: zod.z.string().optional()
+}).transform((userIpInput2) => {
+  const { ip, ipMask, ...numericUserIp } = userIpInput2;
+  if ("string" === typeof ip) {
+    numericUserIp.numericIp = util.getIPAddress(ip).bigInt();
+  }
+  if ("string" === typeof ipMask) {
+    const ipObject = new ipAddress.Address4(ipMask);
+    numericUserIp.numericIpMaskMin = ipObject.startAddress().bigInt();
+    numericUserIp.numericIpMaskMax = ipObject.endAddress().bigInt();
+  }
+  return numericUserIp;
+});
+const userScopeSchema = zod.z.object({
+  ...userIpSchema.shape,
+  ...userAttributesSchema.shape
+});
+const userScopeInput = zod.z.object({}).and(userIpInput).and(userAttributesInput).transform(
+  // transform is used for type safety only - plain "satisfies ZodType<x>" doesn't work after ".and()"
+  (userScopeInput2) => userScopeInput2
+);
+exports.userScopeInput = userScopeInput;
+exports.userScopeSchema = userScopeSchema;

package/dist/cjs/ruleRecord.cjs

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const userAttributesRecordFields = [
+  "userId",
+  "ja4Hash",
+  "headersHash",
+  "userAgent"
+];
+const userIpRecordFields = [
+  "ip",
+  "ipMask"
+];
+const userScopeRecordFields = [
+  ...userAttributesRecordFields,
+  ...userIpRecordFields
+];
+const getUserScopeRecordFromAccessRuleRecord = (ruleRecord) => Object.fromEntries(
+  userScopeRecordFields.map((field) => [field, ruleRecord[field]]).filter(([, value]) => value !== void 0)
+);
+exports.getUserScopeRecordFromAccessRuleRecord = getUserScopeRecordFromAccessRuleRecord;
+exports.userAttributesRecordFields = userAttributesRecordFields;
+exports.userIpRecordFields = userIpRecordFields;
+exports.userScopeRecordFields = userScopeRecordFields;

package/dist/cjs/rulesStorage.cjs

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+var FilterScopeMatch = /* @__PURE__ */ ((FilterScopeMatch2) => {
+  FilterScopeMatch2["Exact"] = "exact";
+  FilterScopeMatch2["Greedy"] = "greedy";
+  return FilterScopeMatch2;
+})(FilterScopeMatch || {});
+exports.FilterScopeMatch = FilterScopeMatch;

package/dist/cjs/transformRule.cjs

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const crypto = require("node:crypto");
+const cidrCalc = require("cidr-calc");
+const ipAddress = require("ip-address");
+const zod = require("zod");
+const policyInput = require("./ruleInput/policyInput.cjs");
+const ruleInput = require("./ruleInput/ruleInput.cjs");
+const userScopeInput = require("./ruleInput/userScopeInput.cjs");
+const RULE_HASH_ALGORITHM = "md5";
+const makeAccessRuleHash = (rule) => {
+  const valueProperties = Object.entries(rule).filter(
+    ([key, value]) => "undefined" !== typeof value
+  );
+  const orderedProperties = valueProperties.sort();
+  const objectToHash = Object.fromEntries(orderedProperties);
+  return hashObject(objectToHash, RULE_HASH_ALGORITHM);
+};
+const transformAccessRuleRecordIntoRule = (ruleRecord) => (
+  // accessRuleInput does all the record field transformations
+  ruleInput.accessRuleInput.parse(ruleRecord)
+);
+const transformAccessRuleIntoRecord = (rule) => accessRuleToRecordScheme.parse(rule);
+const accessRuleToRecordScheme = zod.z.object({
+  ...policyInput.accessPolicyInput.shape,
+  ...policyInput.policyScopeInput.shape,
+  ...userScopeInput.userScopeSchema.shape,
+  groupId: zod.z.coerce.string().optional()
+}).transform((ruleInput2) => {
+  const {
+    groupId,
+    numericIp,
+    numericIpMaskMin,
+    numericIpMaskMax,
+    userAgentHash,
+    ...rule
+  } = ruleInput2;
+  const record = rule;
+  if ("string" === typeof groupId) {
+    record.ruleGroupId = groupId;
+  }
+  if ("string" === typeof userAgentHash) {
+    record.userAgent = userAgentHash;
+  }
+  if ("bigint" === typeof numericIp) {
+    record.ip = getStringIpFromNumeric(numericIp);
+  }
+  if ("bigint" === typeof numericIpMaskMin && "bigint" === typeof numericIpMaskMax) {
+    record.ipMask = getCidrFromNumericIpRange(
+      numericIpMaskMin,
+      numericIpMaskMax
+    );
+  }
+  return record;
+});
+const hashObject = (object, algorithm) => crypto.createHash(algorithm).update(
+  JSON.stringify(
+    object,
+    (key, value) => (
+      // JSON.stringify can't handle BigInt itself: throws "Do not know how to serialize a BigInt"
+      "bigint" === typeof value ? value.toString() : value
+    )
+  )
+).digest("hex");
+const getStringIpFromNumeric = (numericIp) => ipAddress.Address4.fromInteger(Number(numericIp)).address;
+const getCidrFromNumericIpRange = (startIp, endIp) => {
+  const ipRange = new cidrCalc.IpRange(
+    cidrCalc.IpAddress.of(getStringIpFromNumeric(startIp)),
+    cidrCalc.IpAddress.of(getStringIpFromNumeric(endIp))
+  );
+  const cidr = ipRange.toCidrs()[0];
+  return cidr ? `${cidr.prefix.toString()}/${cidr.prefixLen}` : void 0;
+};
+exports.getCidrFromNumericIpRange = getCidrFromNumericIpRange;
+exports.makeAccessRuleHash = makeAccessRuleHash;
+exports.transformAccessRuleIntoRecord = transformAccessRuleIntoRecord;
+exports.transformAccessRuleRecordIntoRule = transformAccessRuleRecordIntoRule;

package/dist/mongoose/.export.js

@@ -0,0 +1,4 @@
+import { accessRuleMongooseSchema } from "./mongooseRuleSchema.js";
+export {
+  accessRuleMongooseSchema
+};

package/dist/mongoose/mongooseRuleSchema.js

@@ -0,0 +1,36 @@
+const userAttributesSchema = {
+  userId: { type: String, required: false },
+  ja4Hash: { type: String, required: false },
+  userAgent: { type: String, required: false },
+  headersHash: { type: String, required: false }
+};
+const userIpSchema = {
+  ip: { type: String, required: false },
+  ipMask: { type: String, required: false }
+};
+const userScopeSchema = {
+  ...userAttributesSchema,
+  ...userIpSchema
+};
+const policyScopeSchema = {
+  clientId: { type: String, required: false }
+};
+const accessPolicySchema = {
+  type: { type: String, required: true },
+  captchaType: { type: String, required: false },
+  description: { type: String, required: false },
+  solvedImagesCount: { type: Number, required: false },
+  imageThreshold: { type: Number, required: false },
+  powDifficulty: { type: Number, required: false },
+  unsolvedImagesCount: { type: Number, required: false },
+  frictionlessScore: { type: Number, required: false }
+};
+const accessRuleMongooseSchema = {
+  ...accessPolicySchema,
+  ...policyScopeSchema,
+  ...userScopeSchema,
+  ruleGroupId: { type: String, required: false }
+};
+export {
+  accessRuleMongooseSchema
+};

package/dist/redis/.export.js

@@ -0,0 +1,6 @@
+import { createRedisAccessRulesStorage } from "./redisRulesStorage.js";
+import { accessRulesRedisIndex } from "./redisRuleIndex.js";
+export {
+  accessRulesRedisIndex,
+  createRedisAccessRulesStorage
+};

package/dist/redis/reader/redisAggregate.js

@@ -0,0 +1,60 @@
+import { z } from "zod";
+import { REDIS_QUERY_DIALECT } from "./redisRulesQuery.js";
+import { parseRedisRecords, REDIS_BATCH_SIZE } from "../redisClient.js";
+import { ACCESS_RULES_REDIS_INDEX_NAME } from "../redisRuleIndex.js";
+const aggregateRedisKeys = async (client, query, logger, batchHandler) => {
+  const keyField = "__key";
+  const recordSchema = z.object({
+    // it's a reserved name for the record key
+    [keyField]: z.string()
+  });
+  const foundKeys = [];
+  const addRecordKeys = async (records) => {
+    const parsedRecords = parseRedisRecords(records, recordSchema, logger);
+    const recordKeys = parsedRecords.map((record) => record[keyField]);
+    if (batchHandler) {
+      await batchHandler(recordKeys);
+    } else {
+      foundKeys.push(...recordKeys);
+      logger.debug(() => ({
+        msg: "Processed aggregation batch",
+        data: {
+          size: recordKeys.length
+        }
+      }));
+    }
+  };
+  await executeAggregation(
+    client,
+    query,
+    {
+      // #2 is a required option when the 'ismissing()' function is in the query body
+      DIALECT: REDIS_QUERY_DIALECT,
+      COUNT: REDIS_BATCH_SIZE,
+      LOAD: `@${keyField}`
+    },
+    addRecordKeys
+  );
+  return foundKeys;
+};
+const executeAggregation = async (client, query, aggregateOptions, handleBatch) => {
+  const initialReply = await client.ft.aggregateWithCursor(
+    ACCESS_RULES_REDIS_INDEX_NAME,
+    query,
+    aggregateOptions
+  );
+  await handleBatch(initialReply.results);
+  let cursor = initialReply.cursor;
+  while (0 !== cursor) {
+    const batchReply = await client.ft.cursorRead(
+      ACCESS_RULES_REDIS_INDEX_NAME,
+      cursor,
+      { COUNT: aggregateOptions.COUNT }
+    );
+    await handleBatch(batchReply.results);
+    cursor = batchReply.cursor;
+  }
+};
+export {
+  aggregateRedisKeys
+};