@prosopo/user-access-policy 3.6.0 → 3.7.11

package/src/tests/insertRulesEndpoint.unit.test.ts

@@ -0,0 +1,89 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import type { Logger } from "@prosopo/logger";
+import { describe, expect, it, vi } from "vitest";
+import { InsertRulesEndpoint } from "#policy/api/write/insertRules.js";
+import { AccessPolicyType } from "#policy/rule.js";
+import type { AccessRulesWriter } from "#policy/rulesStorage.js";
+
+const makeMockLogger = (): Logger =>
+	({
+		trace: vi.fn(),
+		debug: vi.fn(),
+		info: vi.fn(),
+		warn: vi.fn(),
+		error: vi.fn(),
+		fatal: vi.fn(),
+		log: vi.fn(),
+		setLogLevel: vi.fn(),
+		getLogLevel: vi.fn().mockReturnValue("info"),
+		with: vi.fn().mockReturnThis(),
+		getScope: vi.fn().mockReturnValue("test"),
+		getPretty: vi.fn().mockReturnValue(false),
+		setPretty: vi.fn(),
+		getPrintStack: vi.fn().mockReturnValue(false),
+		setPrintStack: vi.fn(),
+		getFormat: vi.fn().mockReturnValue("json"),
+		setFormat: vi.fn(),
+	}) satisfies Logger;
+
+const makeWriter = (): AccessRulesWriter => ({
+	insertRules: vi.fn().mockResolvedValue(["rule-1", "rule-2"]),
+	deleteRules: vi.fn().mockResolvedValue(undefined),
+	deleteAllRules: vi.fn().mockResolvedValue(0),
+});
+
+const sampleArgs = [
+	{
+		accessPolicy: { type: AccessPolicyType.Block },
+		userScopes: [{ userId: "user-1" }, { userId: "user-2" }],
+	},
+];
+
+describe("InsertRulesEndpoint logger selection", () => {
+	it("uses the per-request logger when one is provided to processRequest", async () => {
+		const ctorLogger = makeMockLogger();
+		const requestLogger = makeMockLogger();
+		const endpoint = new InsertRulesEndpoint(makeWriter(), ctorLogger);
+
+		// processRequest races against a 5s timeout and resolves PROCESSING first;
+		// the actual insert + log happens after. Wait long enough for the .then()
+		// chain to fire.
+		await endpoint.processRequest(sampleArgs, requestLogger);
+		await new Promise((r) => setImmediate(r));
+
+		expect(requestLogger.info).toHaveBeenCalled();
+		const calls = (requestLogger.info as ReturnType<typeof vi.fn>).mock.calls;
+		const msgs = calls.map(([fn]) => (fn as () => { msg: string })().msg);
+		expect(msgs).toContain("Endpoint inserted access rules");
+
+		// Constructor logger must not have been touched for the request-path log.
+		expect(ctorLogger.info).not.toHaveBeenCalled();
+	});
+
+	it("falls back to the constructor logger when no request logger is provided", async () => {
+		const ctorLogger = makeMockLogger();
+		const endpoint = new InsertRulesEndpoint(makeWriter(), ctorLogger);
+
+		await endpoint.processRequest(sampleArgs);
+		await new Promise((r) => setImmediate(r));
+
+		expect(ctorLogger.info).toHaveBeenCalled();
+		const msgs = (ctorLogger.info as ReturnType<typeof vi.fn>).mock.calls.map(
+			([fn]) => (fn as () => { msg: string })().msg,
+		);
+		expect(msgs).toContain("Endpoint inserted access rules");
+	});
+});

package/src/tests/policyInput.unit.test.ts

@@ -0,0 +1,150 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { CaptchaType } from "@prosopo/types";
+import { describe, expect, it } from "vitest";
+import { AccessPolicyType } from "#policy/rule.js";
+import { sanitizeAccessPolicy } from "#policy/ruleInput/policyInput.js";
+
+describe("sanitizeAccessPolicy", () => {
+	describe("block policies", () => {
+		it("should remove captchaType from block policies", () => {
+			const input = {
+				type: AccessPolicyType.Block,
+				captchaType: CaptchaType.image,
+				description: "test block policy",
+			};
+
+			const result = sanitizeAccessPolicy(input);
+
+			expect(result).toEqual({
+				type: AccessPolicyType.Block,
+				description: "test block policy",
+			});
+			expect(result.captchaType).toBeUndefined();
+		});
+
+		it("should remove solvedImagesCount from block policies", () => {
+			const input = {
+				type: AccessPolicyType.Block,
+				solvedImagesCount: 5,
+				description: "test block policy",
+			};
+
+			const result = sanitizeAccessPolicy(input);
+
+			expect(result).toEqual({
+				type: AccessPolicyType.Block,
+				description: "test block policy",
+			});
+			expect(result.solvedImagesCount).toBeUndefined();
+		});
+
+		it("should remove both captchaType and solvedImagesCount from block policies", () => {
+			const input = {
+				type: AccessPolicyType.Block,
+				captchaType: CaptchaType.image,
+				solvedImagesCount: 5,
+				description: "test block policy",
+			};
+
+			const result = sanitizeAccessPolicy(input);
+
+			expect(result).toEqual({
+				type: AccessPolicyType.Block,
+				description: "test block policy",
+			});
+			expect(result.captchaType).toBeUndefined();
+			expect(result.solvedImagesCount).toBeUndefined();
+		});
+
+		it("should keep other fields in block policies", () => {
+			const input = {
+				type: AccessPolicyType.Block,
+				captchaType: CaptchaType.image,
+				solvedImagesCount: 5,
+				description: "test block policy",
+				imageThreshold: 0.5,
+				powDifficulty: 10,
+				unsolvedImagesCount: 3,
+				frictionlessScore: 100,
+			};
+
+			const result = sanitizeAccessPolicy(input);
+
+			expect(result).toEqual({
+				type: AccessPolicyType.Block,
+				description: "test block policy",
+				imageThreshold: 0.5,
+				powDifficulty: 10,
+				unsolvedImagesCount: 3,
+				frictionlessScore: 100,
+			});
+			expect(result.captchaType).toBeUndefined();
+			expect(result.solvedImagesCount).toBeUndefined();
+		});
+	});
+
+	describe("restrict policies", () => {
+		it("should keep captchaType in restrict policies", () => {
+			const input = {
+				type: AccessPolicyType.Restrict,
+				captchaType: CaptchaType.image,
+				description: "test restrict policy",
+			};
+
+			const result = sanitizeAccessPolicy(input);
+
+			expect(result).toEqual({
+				type: AccessPolicyType.Restrict,
+				captchaType: CaptchaType.image,
+				description: "test restrict policy",
+			});
+		});
+
+		it("should keep solvedImagesCount in restrict policies", () => {
+			const input = {
+				type: AccessPolicyType.Restrict,
+				solvedImagesCount: 5,
+				description: "test restrict policy",
+			};
+
+			const result = sanitizeAccessPolicy(input);
+
+			expect(result).toEqual({
+				type: AccessPolicyType.Restrict,
+				solvedImagesCount: 5,
+				description: "test restrict policy",
+			});
+		});
+
+		it("should keep both captchaType and solvedImagesCount in restrict policies", () => {
+			const input = {
+				type: AccessPolicyType.Restrict,
+				captchaType: CaptchaType.image,
+				solvedImagesCount: 5,
+				description: "test restrict policy",
+			};
+
+			const result = sanitizeAccessPolicy(input);
+
+			expect(result).toEqual({
+				type: AccessPolicyType.Restrict,
+				captchaType: CaptchaType.image,
+				solvedImagesCount: 5,
+				description: "test restrict policy",
+			});
+		});
+	});
+});

package/src/tests/redis/reader/redisRulesQuery.unit.test.ts

@@ -0,0 +1,284 @@
+// Copyright 2021-2026 Prosopo (UK) Ltd.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import { describe, expect, it } from "vitest";
+import { getRulesRedisQuery } from "#policy/redis/reader/redisRulesQuery.js";
+import {
+	type AccessRulesFilter,
+	FilterScopeMatch,
+} from "#policy/rulesStorage.js";
+
+describe("getRulesRedisQuery", () => {
+	it("puts ismissing(x) for field x passed in as `undefined` when user scope match is exact", () => {
+		const filter = {
+			userScope: {
+				numericIp: BigInt(100),
+				ja4Hash: "ja4Hash",
+				userAgentHash: undefined,
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, false);
+
+		expect(query).toBe(
+			"( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) )",
+		);
+	});
+
+	it("puts ismissing(x) for field x passed in as `undefined` when user scope match is exact and for missing fields when matchingFieldsOnly is set", () => {
+		const filter = {
+			userScope: {
+				numericIp: BigInt(100),
+				ja4Hash: "ja4Hash",
+				userAgentHash: undefined,
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, true);
+
+		expect(query).toBe(
+			"( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@userId) ismissing(@headersHash) ismissing(@headHash) ismissing(@coords) ismissing(@countryCode) )",
+		);
+	});
+
+	it("puts ismissing(x) for multiple fields passed in as `undefined` when user scope match is exact", () => {
+		const filter = {
+			userScope: {
+				numericIp: BigInt(100),
+				ja4Hash: "ja4Hash",
+				userAgentHash: undefined,
+				headersHash: undefined,
+				userId: undefined,
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, false);
+
+		expect(query).toBe(
+			"( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) )",
+		);
+	});
+
+	it("does not put ismissing(x) for multiple fields passed in as `undefined` when user scope match is greedy", () => {
+		const filter = {
+			userScope: {
+				numericIp: BigInt(100),
+				ja4Hash: "ja4Hash",
+				userAgentHash: undefined,
+				headersHash: undefined,
+				userId: undefined,
+			},
+			userScopeMatch: FilterScopeMatch.Greedy,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, false);
+
+		expect(query).toBe(
+			"( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) | @ja4Hash:{ja4Hash} )",
+		);
+	});
+
+	it("puts ismissing(x) for multiple fields passed in as `undefined` when user scope match is exact 2", () => {
+		const filter = {
+			userScope: {
+				numericIp: undefined,
+				ja4Hash: "ja4Hash",
+				userAgentHash: undefined,
+				headersHash: undefined,
+				userId: undefined,
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, false);
+
+		expect(query).toBe(
+			"( ismissing(@numericIp) ismissing(@numericIpMaskMin) ismissing(@numericIpMaskMax) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) )",
+		);
+	});
+
+	it("does not put ismissing(numericIpMaskMin) and does not put ismissing(numericIpMaskMax) when numericIp is passed in", () => {
+		const filter = {
+			userScope: {
+				numericIp: BigInt(100),
+				ja4Hash: "ja4Hash",
+				userAgentHash: undefined,
+				headersHash: undefined,
+				userId: undefined,
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, true);
+
+		expect(query).toBe(
+			"( ( @numericIp:[100 100] | ( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[100 +inf] ) ) @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) ismissing(@headHash) ismissing(@coords) ismissing(@countryCode) )",
+		);
+	});
+
+	it("does not put ismissing(numericIp) when numericIpMaskMin and numericIpMaskMax are passed in", () => {
+		const filter = {
+			userScope: {
+				numericIpMaskMin: BigInt(100),
+				numericIpMaskMax: BigInt(200),
+				ja4Hash: "ja4Hash",
+				userAgentHash: undefined,
+				headersHash: undefined,
+				userId: undefined,
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, true);
+
+		expect(query).toBe(
+			"( @numericIpMaskMin:[-inf 100] @numericIpMaskMax:[200 +inf] @ja4Hash:{ja4Hash} ismissing(@userAgentHash) ismissing(@headersHash) ismissing(@userId) ismissing(@headHash) ismissing(@coords) ismissing(@countryCode) )",
+		);
+	});
+
+	it("does not duplicate ismissing for numericIpMaskMin and numericIpMaskMax when matchingFieldsOnly is true and all IP fields are undefined", () => {
+		const filter = {
+			userScope: {
+				userId: "user123",
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, true);
+
+		// numericIp handler emits all three ismissing clauses when all IP fields are undefined.
+		// The individual numericIpMaskMin and numericIpMaskMax handlers should not duplicate them.
+		const numericIpMaskMinMatches = query.match(
+			/ismissing\(@numericIpMaskMin\)/g,
+		);
+		const numericIpMaskMaxMatches = query.match(
+			/ismissing\(@numericIpMaskMax\)/g,
+		);
+
+		expect(numericIpMaskMinMatches).toHaveLength(1);
+		expect(numericIpMaskMaxMatches).toHaveLength(1);
+		expect(query).toContain("ismissing(@numericIp)");
+		expect(query).toContain("@userId:{user123}");
+	});
+
+	it("emits ismissing for numericIpMaskMin when numericIpMaskMax is defined but numericIpMaskMin is not", () => {
+		const filter = {
+			userScope: {
+				numericIpMaskMax: BigInt(200),
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, true);
+
+		// numericIp handler returns "" because numericIpMaskMax is defined.
+		// numericIpMaskMin handler should still emit ismissing since the numericIp handler didn't cover it.
+		expect(query).toContain("ismissing(@numericIpMaskMin)");
+		expect(query).toContain("@numericIpMaskMax:[200 +inf]");
+		expect(query).not.toContain("ismissing(@numericIpMaskMax)");
+	});
+
+	it("emits ismissing for numericIpMaskMax when numericIpMaskMin is defined but numericIpMaskMax is not", () => {
+		const filter = {
+			userScope: {
+				numericIpMaskMin: BigInt(100),
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, true);
+
+		expect(query).toContain("@numericIpMaskMin:[-inf 100]");
+		expect(query).toContain("ismissing(@numericIpMaskMax)");
+		expect(query).not.toContain("ismissing(@numericIpMaskMin)");
+	});
+
+	it("includes headHash in query when provided", () => {
+		const filter = {
+			userScope: {
+				headHash: "abc123def456",
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, false);
+
+		expect(query).toBe("( @headHash:{abc123def456} )");
+	});
+
+	it("includes coords in query when provided with escaped special characters", () => {
+		const filter = {
+			userScope: {
+				coords: "[[[100,200]]]",
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, false);
+
+		// Special characters like [, ], and , should be escaped
+		expect(query).toContain("@coords:{\\[\\[\\[100\\,200\\]\\]\\]}");
+	});
+
+	it("includes both headHash and coords when both provided", () => {
+		const filter = {
+			userScope: {
+				headHash: "abc123def456",
+				coords: "[[[100,200]]]",
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, false);
+
+		expect(query).toContain("@headHash:{abc123def456}");
+		expect(query).toContain("@coords:{\\[\\[\\[100\\,200\\]\\]\\]}");
+	});
+
+	it("puts ismissing(headHash) and ismissing(coords) when not provided and matchingFieldsOnly is true", () => {
+		const filter = {
+			userScope: {
+				ja4Hash: "ja4Hash",
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, true);
+
+		expect(query).toContain("ismissing(@headHash)");
+		expect(query).toContain("ismissing(@coords)");
+	});
+
+	it("combines headHash with other fields correctly in exact match", () => {
+		const filter = {
+			userScope: {
+				numericIp: BigInt(100),
+				ja4Hash: "ja4Hash",
+				headHash: "abc123def456",
+				userAgentHash: undefined,
+			},
+			userScopeMatch: FilterScopeMatch.Exact,
+		} as AccessRulesFilter;
+
+		const query = getRulesRedisQuery(filter, false);
+
+		expect(query).toContain("@numericIp:[100 100]");
+		expect(query).toContain("@ja4Hash:{ja4Hash}");
+		expect(query).toContain("@headHash:{abc123def456}");
+		expect(query).toContain("ismissing(@userAgentHash)");
+	});
+});