@prosopo/user-access-policy 3.9.1 → 3.10.0

package/dist/tests/redis/redisRulesReaderRank.benchmark.integration.test.js

@@ -0,0 +1,189 @@
+import { chunkIntoBatches, executeBatchesSequentially } from "@prosopo/common";
+import { createTestRedisConnection, setupRedisIndex, } from "@prosopo/redis-client";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { RedisRulesReader } from "#policy/redis/reader/redisRulesReader.js";
+import { ACCESS_RULES_REDIS_INDEX_NAME, accessRulesRedisIndex, getAccessRuleRedisKey, } from "#policy/redis/redisRuleIndex.js";
+import { getRedisRuleValue } from "#policy/redis/redisRulesWriter.js";
+import { AccessPolicyType } from "#policy/rule.js";
+import { FilterScopeMatch } from "#policy/rulesStorage.js";
+const RULE_COUNT = 10_000;
+const QUERY_COUNT = 200;
+const P50_LATENCY_MS = 80;
+const P99_LATENCY_MS = 250;
+const buildBenchmarkRule = (i) => {
+    const bucket = i % 10;
+    const ja4 = `t13d_bench_${(i % 50).toString().padStart(3, "0")}`;
+    const asn = 1000 + (i % 500);
+    const description = `bench-rule-${i}`;
+    if (bucket < 7) {
+        const variant = i % 3;
+        if (variant === 0)
+            return { type: AccessPolicyType.Block, description, ja4Hash: ja4 };
+        if (variant === 1)
+            return {
+                type: AccessPolicyType.Block,
+                description,
+                asn,
+            };
+        return {
+            type: AccessPolicyType.Restrict,
+            description,
+            countryCode: `C${i % 30}`,
+        };
+    }
+    if (bucket < 9) {
+        return {
+            type: AccessPolicyType.Block,
+            description,
+            clientId: `client${i % 20}`,
+            ja4Hash: ja4,
+            ...(i % 2 === 0 && { userAgentHash: `ua${i % 100}` }),
+        };
+    }
+    return {
+        type: AccessPolicyType.Block,
+        description,
+        clientId: `client${i % 20}`,
+        ja4Hash: ja4,
+        userAgentHash: `ua${i % 100}`,
+        headersHash: `hh${i % 200}`,
+        countryCode: `C${i % 30}`,
+    };
+};
+const buildBenchmarkRequest = (i) => {
+    return {
+        clientId: `client${i % 20}`,
+        scope: {
+            ja4Hash: `t13d_bench_${(i % 50).toString().padStart(3, "0")}`,
+            userAgentHash: `ua${i % 100}`,
+            headersHash: `hh${i % 200}`,
+            countryCode: `C${i % 30}`,
+            asn: 1000 + (i % 500),
+        },
+    };
+};
+const percentile = (sortedMs, q) => {
+    if (sortedMs.length === 0)
+        return 0;
+    const idx = Math.min(sortedMs.length - 1, Math.floor((sortedMs.length - 1) * q));
+    const v = sortedMs[idx];
+    return v ?? 0;
+};
+describe("redisRulesReader ranked-path benchmark", () => {
+    let redisConnection;
+    let redisClient;
+    let reader;
+    const mockLogger = new Proxy({}, {
+        get: () => () => { },
+    });
+    const seededKeys = [];
+    beforeAll(async () => {
+        redisConnection = createTestRedisConnection();
+        redisClient = await setupRedisIndex(redisConnection, accessRulesRedisIndex, mockLogger).getClient();
+        reader = new RedisRulesReader(redisClient, mockLogger);
+        const rules = [];
+        for (let i = 0; i < RULE_COUNT; i++) {
+            rules.push(buildBenchmarkRule(i));
+        }
+        await executeBatchesSequentially(chunkIntoBatches(rules, 1000), async (batch) => {
+            const multi = redisClient.multi();
+            for (const rule of batch) {
+                const key = getAccessRuleRedisKey(rule);
+                seededKeys.push(key);
+                multi.hSet(key, getRedisRuleValue(rule));
+            }
+            await multi.exec();
+        });
+        const indexInfo = await redisClient.ft.info(ACCESS_RULES_REDIS_INDEX_NAME);
+        expect(indexInfo.num_docs).toBeGreaterThan(RULE_COUNT * 0.9);
+    }, 120_000);
+    afterAll(async () => {
+        await executeBatchesSequentially(chunkIntoBatches(seededKeys, 1000), async (batch) => {
+            const multi = redisClient.multi();
+            for (const key of batch) {
+                multi.del(key);
+            }
+            await multi.exec();
+        });
+    });
+    test(`ranked findRules p50/p99 over ${QUERY_COUNT} queries against ${RULE_COUNT} rules`, async () => {
+        await reader.findRules({
+            policyScope: { clientId: "warmup" },
+            policyScopeMatch: FilterScopeMatch.Greedy,
+            userScope: { ja4Hash: "warmup" },
+            userScopeMatch: FilterScopeMatch.Greedy,
+        }, true);
+        const samples = [];
+        for (let i = 0; i < QUERY_COUNT; i++) {
+            const { clientId, scope } = buildBenchmarkRequest(i);
+            const start = performance.now();
+            await reader.findRules({
+                policyScope: { clientId },
+                policyScopeMatch: FilterScopeMatch.Greedy,
+                userScope: scope,
+                userScopeMatch: FilterScopeMatch.Greedy,
+            }, true);
+            samples.push(performance.now() - start);
+        }
+        samples.sort((a, b) => a - b);
+        const p50 = percentile(samples, 0.5);
+        const p99 = percentile(samples, 0.99);
+        const avg = samples.reduce((a, b) => a + b, 0) / samples.length;
+        console.log(`ranked findRules: avg=${avg.toFixed(2)}ms  p50=${p50.toFixed(2)}ms  p99=${p99.toFixed(2)}ms  n=${samples.length}`);
+        expect(p50).toBeLessThan(P50_LATENCY_MS);
+        expect(p99).toBeLessThan(P99_LATENCY_MS);
+    }, 120_000);
+    test("ranked findRules result size is bounded by SERVER_SIDE_RANK_TOP_N", async () => {
+        const { clientId, scope } = buildBenchmarkRequest(0);
+        const results = await reader.findRules({
+            policyScope: { clientId },
+            policyScopeMatch: FilterScopeMatch.Greedy,
+            userScope: scope,
+            userScopeMatch: FilterScopeMatch.Greedy,
+        }, true);
+        expect(results.length).toBeLessThanOrEqual(20);
+        expect(results.length).toBeGreaterThan(0);
+    }, 60_000);
+    test("HGETALL-free: ranked path returns full rules without per-rule fanout", async () => {
+        const { clientId, scope } = buildBenchmarkRequest(0);
+        const ranked = await reader.findRules({
+            policyScope: { clientId },
+            policyScopeMatch: FilterScopeMatch.Greedy,
+            userScope: scope,
+            userScopeMatch: FilterScopeMatch.Greedy,
+        }, true);
+        expect(ranked.length).toBeGreaterThan(0);
+        for (const rule of ranked) {
+            expect(rule.type).toBeDefined();
+        }
+    }, 60_000);
+    test("ranked findRules returns rules in specificity-descending order", async () => {
+        const { clientId, scope } = buildBenchmarkRequest(9);
+        const results = await reader.findRules({
+            policyScope: { clientId },
+            policyScopeMatch: FilterScopeMatch.Greedy,
+            userScope: scope,
+            userScopeMatch: FilterScopeMatch.Greedy,
+        }, true);
+        if (results.length === 0)
+            return;
+        const top = results[0];
+        if (!top)
+            return;
+        const countFields = (r) => (r.userId ? 1 : 0) +
+            (r.ja4Hash ? 1 : 0) +
+            (r.headersHash ? 1 : 0) +
+            (r.userAgentHash ? 1 : 0) +
+            (r.headHash ? 1 : 0) +
+            (r.coords ? 1 : 0) +
+            (r.countryCode ? 1 : 0) +
+            (r.asn !== undefined ? 1 : 0) +
+            (r.clientId ? 1 : 0) +
+            (r.numericIp !== undefined || r.numericIpMaskMin !== undefined ? 1 : 0);
+        const topScore = countFields(top);
+        for (const r of results) {
+            expect(countFields(r)).toBeLessThanOrEqual(topScore);
+        }
+    }, 60_000);
+});
+//# sourceMappingURL=redisRulesReaderRank.benchmark.integration.test.js.map

package/dist/tests/redis/redisRulesReaderRank.benchmark.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redisRulesReaderRank.benchmark.integration.test.js","sourceRoot":"","sources":["../../../src/tests/redis/redisRulesReaderRank.benchmark.integration.test.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EAEN,yBAAyB,EACzB,eAAe,GACf,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAC5E,OAAO,EACN,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAmB,MAAM,iBAAiB,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAgB3D,MAAM,UAAU,GAAG,MAAM,CAAC;AAC1B,MAAM,WAAW,GAAG,GAAG,CAAC;AAOxB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,cAAc,GAAG,GAAG,CAAC;AAO3B,MAAM,kBAAkB,GAAG,CAAC,CAAS,EAAc,EAAE;IACpD,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;IACtB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACjE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IAK7B,MAAM,WAAW,GAAG,cAAc,CAAC,EAAE,CAAC;IAEtC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAEhB,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,OAAO,KAAK,CAAC;YAChB,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;QACpE,IAAI,OAAO,KAAK,CAAC;YAChB,OAAO;gBACN,IAAI,EAAE,gBAAgB,CAAC,KAAK;gBAC5B,WAAW;gBACX,GAAG;aACH,CAAC;QACH,OAAO;YACN,IAAI,EAAE,gBAAgB,CAAC,QAAQ;YAC/B,WAAW;YACX,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;SACzB,CAAC;IACH,CAAC;IAED,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAEhB,OAAO;YACN,IAAI,EAAE,gBAAgB,CAAC,KAAK;YAC5B,WAAW;YACX,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE;YAC3B,OAAO,EAAE,GAAG;YACZ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,GAAG,GAAG,EAAE,EAAE,CAAC;SACrD,CAAC;IACH,CAAC;IAGD,OAAO;QACN,IAAI,EAAE,gBAAgB,CAAC,KAAK;QAC5B,WAAW;QACX,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE;QAC3B,OAAO,EAAE,GAAG;QACZ,aAAa,EAAE,KAAK,CAAC,GAAG,GAAG,EAAE;QAC7B,WAAW,EAAE,KAAK,CAAC,GAAG,GAAG,EAAE;QAC3B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;KACzB,CAAC;AACH,CAAC,CAAC;AAOF,MAAM,qBAAqB,GAAG,CAAC,CAAS,EAAE,EAAE;IAC3C,OAAO;QACN,QAAQ,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE;QAC3B,KAAK,EAAE;YACN,OAAO,EAAE,cAAc,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YAC7D,aAAa,EAAE,KAAK,CAAC,GAAG,GAAG,EAAE;YAC7B,WAAW,EAAE,KAAK,CAAC,GAAG,GAAG,EAAE;YAC3B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;YACzB,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;SACrB;KACD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,UAAU,GAAG,CAAC,QAAkB,EAAE,CAAS,EAAU,EAAE;IAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CACnB,QAAQ,CAAC,MAAM,GAAG,CAAC,EACnB,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CACrC,CAAC;IACF,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxB,OAAO,CAAC,IAAI,CAAC,CAAC;AACf,CAAC,CAAC;AAEF,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACvD,IAAI,eAAgC,CAAC;IACrC,IAAI,WAA4B,CAAC;IACjC,IAAI,MAAwB,CAAC;IAE7B,MAAM,UAAU,GAAG,IAAI,KAAK,CAC3B,EAAE,EACF;QACC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,EAAE,GAAE,CAAC;KACnB,CACoB,CAAC;IAIvB,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,SAAS,CAAC,KAAK,IAAI,EAAE;QACpB,eAAe,GAAG,yBAAyB,EAAE,CAAC;QAC9C,WAAW,GAAG,MAAM,eAAe,CAClC,eAAe,EACf,qBAAqB,EACrB,UAAU,CACV,CAAC,SAAS,EAAE,CAAC;QACd,MAAM,GAAG,IAAI,gBAAgB,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAIvD,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,MAAM,0BAA0B,CAC/B,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,EAC7B,KAAK,EAAE,KAAK,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,MAAM,GAAG,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBACxC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACrB,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC,CACD,CAAC;QAEF,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAG3E,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,eAAe,CAAC,UAAU,GAAG,GAAG,CAAC,CAAC;IAC9D,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,QAAQ,CAAC,KAAK,IAAI,EAAE;QAInB,MAAM,0BAA0B,CAC/B,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,EAClC,KAAK,EAAE,KAAK,EAAE,EAAE;YACf,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC;YAClC,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,CAAC;YACD,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,CAAC,CACD,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iCAAiC,WAAW,oBAAoB,UAAU,QAAQ,EAAE,KAAK,IAAI,EAAE;QAEnG,MAAM,MAAM,CAAC,SAAS,CACrB;YACC,WAAW,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;YACnC,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;YACzC,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE;YAChC,cAAc,EAAE,gBAAgB,CAAC,MAAM;SACvC,EACD,IAAI,CACJ,CAAC;QAEF,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,MAAM,CAAC,SAAS,CACrB;gBACC,WAAW,EAAE,EAAE,QAAQ,EAAE;gBACzB,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;gBACzC,SAAS,EAAE,KAAK;gBAChB,cAAc,EAAE,gBAAgB,CAAC,MAAM;aACvC,EACD,IAAI,CACJ,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC;QACzC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;QAEhE,OAAO,CAAC,GAAG,CACV,yBAAyB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,MAAM,EAAE,CAClH,CAAC;QAEF,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QACzC,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAC1C,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,IAAI,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QAGpF,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CACrC;YACC,WAAW,EAAE,EAAE,QAAQ,EAAE;YACzB,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;YACzC,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,gBAAgB,CAAC,MAAM;SACvC,EACD,IAAI,CACJ,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,IAAI,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QAcvF,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CACpC;YACC,WAAW,EAAE,EAAE,QAAQ,EAAE;YACzB,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;YACzC,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,gBAAgB,CAAC,MAAM;SACvC,EACD,IAAI,CACJ,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAIzC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QACjC,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,IAAI,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAGjF,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,qBAAqB,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CACrC;YACC,WAAW,EAAE,EAAE,QAAQ,EAAE;YACzB,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;YACzC,SAAS,EAAE,KAAK;YAChB,cAAc,EAAE,gBAAgB,CAAC,MAAM;SACvC,EACD,IAAI,CACJ,CAAC;QAEF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,GAAG;YAAE,OAAO;QAIjB,MAAM,WAAW,GAAG,CAAC,CAAa,EAAU,EAAE,CAC7C,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7B,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEzE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QACtD,CAAC;IACF,CAAC,EAAE,MAAM,CAAC,CAAC;AACZ,CAAC,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@prosopo/user-access-policy",
-	"version": "3.9.1",
+	"version": "3.10.0",
 	"type": "module",
 	"engines": {
 		"node": "^24",
@@ -43,12 +43,12 @@
 		"test": "npm run test:unit && npm run test:integration"
 	},
 	"dependencies": {
-		"@prosopo/api": "3.4.11",
+		"@prosopo/api": "3.4.12",
 		"@prosopo/api-route": "2.6.46",
 		"@prosopo/common": "3.1.38",
 		"@prosopo/logger": "1.0.2",
 		"@prosopo/redis-client": "1.0.23",
-		"@prosopo/types": "4.4.1",
+		"@prosopo/types": "4.5.0",
 		"@prosopo/util": "3.2.15",
 		"@redis/search": "5.0.0",
 		"cidr-calc": "1.0.4",

package/src/redis/reader/redisRulesReader.ts

@@ -16,15 +16,21 @@ import * as util from "node:util";
 import { chunkIntoBatches, executeBatchesSequentially } from "@prosopo/common";
 import type { Logger } from "@prosopo/logger";
 import type { RedisClientType } from "redis";
-import { getRulesRedisQuery } from "#policy/redis/reader/redisRulesQuery.js";
+import {
+	REDIS_QUERY_DIALECT,
+	getRulesRedisQuery,
+} from "#policy/redis/reader/redisRulesQuery.js";
 import {
 	REDIS_BATCH_SIZE,
 	fetchRedisHashRecords,
 	getMissingRedisKeys,
 	parseRedisRecords,
 } from "#policy/redis/redisClient.js";
-import { ACCESS_RULE_REDIS_KEY_PREFIX } from "#policy/redis/redisRuleIndex.js";
-import type { AccessRule } from "#policy/rule.js";
+import {
+	ACCESS_RULES_REDIS_INDEX_NAME,
+	ACCESS_RULE_REDIS_KEY_PREFIX,
+} from "#policy/redis/redisRuleIndex.js";
+import { AccessPolicyType, type AccessRule } from "#policy/rule.js";
 import { accessRuleInput } from "#policy/ruleInput/ruleInput.js";
 import type {
 	AccessRuleEntry,
@@ -33,14 +39,90 @@ import type {
 } from "#policy/rulesStorage.js";
 import { aggregateRedisKeys } from "./redisAggregate.js";
 
-// Verify-time lookup safety cap. The greedy `userScopeMatch` OR-query can match
-// thousands of candidates on bot-attack-scale accounts; we still need to bring
-// every candidate back so JS-side specificity ranking can pick the right rule,
-// but a hard cap prevents a pathological match (e.g. an attacker crafting a
-// userScope that hits the entire account's rule index) from spiralling the
-// per-request cost. 10× the page size leaves comfortable headroom over the
-// observed worst case (~2k candidates).
-export const FIND_RULES_MAX_CANDIDATES = REDIS_BATCH_SIZE * 10;
+// Server-side specificity ranking config.
+//
+// Strict-match findRules (matchingFieldsOnly=true) used to pull every
+// matching rule's hash into Node and sort in JS. With the greedy regression
+// in #2689 this hauled ~1190 hashes per request and pegged provider CPU.
+//
+// The new path lets RediSearch compute specificity itself: one
+// FT.AGGREGATE that filters via the strict AND-of-disjunctions query,
+// counts populated rule fields with APPLY+exists(), sorts by that
+// derived score DESC, and returns only the top-N candidates. Node
+// receives at most TOP_N small records, no HGETALL fanout, no JS rank.
+//
+// TOP_N >> 1 leaves headroom for the deferToVerify filter that runs
+// post-aggregate (a Block rule with deferToVerify is skipped in the
+// blockMiddleware path, so we need a few alternates ready). 20 covers
+// the worst observed concentration of deferToVerify rules per scope by
+// comfortable margin while keeping payload tiny.
+export const SERVER_SIDE_RANK_TOP_N = 20;
+
+// Safety cap for the greedy (admin/internal) path. Generous because
+// admin tooling depends on the full result set; not on the hot
+// per-request path.
+const GREEDY_MAX_CANDIDATES = REDIS_BATCH_SIZE * 10;
+
+// Fields that contribute one specificity point each. Mirrors
+// SCALAR_USER_SCOPE_FIELDS + clientId + ip-constraint in
+// blacklistRequestInspector.ruleSpecificity. numericIp and the
+// numericIpMaskMin range are mutually exclusive on a rule (see
+// ruleHasIpConstraint), so `exists(@numericIp) + exists(@numericIpMaskMin)`
+// contributes 1 in practice — never 2 — when applied to writer-produced
+// rules.
+const SPECIFICITY_EXPR = [
+	"exists(@clientId)",
+	"exists(@userId)",
+	"exists(@ja4Hash)",
+	"exists(@headersHash)",
+	"exists(@userAgentHash)",
+	"exists(@headHash)",
+	"exists(@coords)",
+	"exists(@countryCode)",
+	"exists(@asn)",
+	"exists(@numericIp)",
+	"exists(@numericIpMaskMin)",
+].join(" + ");
+
+// Block outranks Restrict on equal specificity (defensive: a request
+// that would match a Block rule must never be downgraded). Note the
+// string literal is lowercase because AccessPolicyType.Block = "block"
+// and getRedisRuleValue serialises via String().
+const SEVERITY_EXPR = `(@type == "${AccessPolicyType.Block}")`;
+
+// Final rank: specificity weighted, severity as tiebreaker on equal
+// specificity. spec*2 + sev fits both into a single sortable float.
+const RANK_EXPR = "(@_spec * 2) + @_sev";
+
+// Every field referenced by SPECIFICITY_EXPR/SEVERITY_EXPR, plus the
+// fields needed to reconstruct an AccessRule downstream. APPLY can only
+// see fields explicitly loaded into the aggregate pipeline, so this
+// list must include every rule attribute the parser cares about.
+const RULE_LOAD_FIELDS = [
+	"@__key",
+	"@type",
+	"@captchaType",
+	"@description",
+	"@solvedImagesCount",
+	"@imageThreshold",
+	"@powDifficulty",
+	"@unsolvedImagesCount",
+	"@frictionlessScore",
+	"@deferToVerify",
+	"@clientId",
+	"@groupId",
+	"@userId",
+	"@ja4Hash",
+	"@headersHash",
+	"@userAgentHash",
+	"@headHash",
+	"@coords",
+	"@countryCode",
+	"@asn",
+	"@numericIp",
+	"@numericIpMaskMin",
+	"@numericIpMaskMax",
+] as const;
 
 export class RedisRulesReader implements AccessRulesReader {
 	constructor(
@@ -87,23 +169,107 @@ export class RedisRulesReader implements AccessRulesReader {
 			return [];
 		}
 
+		// Hot path: strict-match callers (blockMiddleware /
+		// checkForHardBlock) get server-side specificity ranking via
+		// FT.AGGREGATE — Redis returns the top N candidates already
+		// sorted, no HGETALL fanout. See SPECIFICITY_EXPR / RANK_EXPR
+		// above for the score definition.
+		if (matchingFieldsOnly) {
+			return this.findRulesRanked(filter, query);
+		}
+
+		// Admin / internal callers (greedy mode): keep the FT.SEARCH +
+		// HGETALL fanout path. Cap at REDIS_BATCH_SIZE; truncation past
+		// that point is the known liability tracked in #2689.
+		return this.findRulesGreedy(filter, query);
+	}
+
+	private async findRulesRanked(
+		filter: AccessRulesFilter,
+		query: string,
+	): Promise<AccessRule[]> {
+		try {
+			const reply = await this.client.ft.aggregate(
+				ACCESS_RULES_REDIS_INDEX_NAME,
+				query,
+				{
+					DIALECT: REDIS_QUERY_DIALECT,
+					LOAD: [...RULE_LOAD_FIELDS],
+					STEPS: [
+						{ type: "APPLY", expression: SPECIFICITY_EXPR, AS: "_spec" },
+						{ type: "APPLY", expression: SEVERITY_EXPR, AS: "_sev" },
+						{ type: "APPLY", expression: RANK_EXPR, AS: "_rank" },
+						{
+							type: "SORTBY",
+							BY: [{ BY: "@_rank", DIRECTION: "DESC" }],
+							// SORTBY MAX would let RediSearch keep only the
+							// top-N in a bounded heap rather than fully
+							// sorting, but the @redis/search client
+							// serialises MAX *before* DESC and RediSearch
+							// rejects that order ("MISSING ASC or DESC
+							// after sort field (MAX)"). LIMIT below still
+							// trims; SORTBY does a full sort. Acceptable
+							// because the strict-match filter already
+							// keeps the candidate set small in practice.
+						},
+						{ type: "LIMIT", from: 0, size: SERVER_SIDE_RANK_TOP_N },
+					],
+				},
+			);
+
+			if (reply.results.length === 0) {
+				return [];
+			}
+
+			this.logger.debug(() => ({
+				msg: "Executed ranked search query",
+				data: {
+					inspect: util.inspect(
+						{
+							filter: filter,
+							foundCount: reply.results.length,
+							query: query,
+						},
+						{ depth: null },
+					),
+				},
+			}));
+
+			// FT.AGGREGATE results include the derived _spec/_sev/_rank
+			// fields and the loaded rule fields. parseRedisRecords runs
+			// through zod which ignores the derived fields. __key is
+			// also passed through but unused downstream.
+			return parseRedisRecords(reply.results, accessRuleInput, this.logger);
+		} catch (e) {
+			this.logger.error(() => ({
+				err: e,
+				data: {
+					inspect: util.inspect({ query, filter }, { depth: null }),
+				},
+				msg: "failed to execute ranked search query",
+			}));
+
+			return [];
+		}
+	}
+
+	// Used only by admin / internal callers (matchingFieldsOnly=false).
+	// Not on the per-request blockMiddleware path any more, so the CPU
+	// cost of the HGETALL fanout is acceptable. Same shape as #2689's
+	// aggregate-with-cursor: returns every candidate up to
+	// GREEDY_MAX_CANDIDATES so we don't silently drop matches that
+	// admin tools depend on (e.g. ASN-wide rule listings).
+	private async findRulesGreedy(
+		filter: AccessRulesFilter,
+		query: string,
+	): Promise<AccessRule[]> {
 		try {
-			// FT.AGGREGATE WITHCURSOR (via aggregateRedisKeys) instead of
-			// FT.SEARCH. FT.SEARCH's LIMIT caps the candidate set at
-			// REDIS_BATCH_SIZE (1000), silently dropping anything past that.
-			// Under the greedy `userScopeMatch` mode (#2657), the OR-of-fields
-			// query for a popular ja4 hash returns thousands of candidates —
-			// matches sitting past offset 1000 (block rules emitted by
-			// less-frequent detectors like SUDDEN_VOLUME_INCREASE) were lost,
-			// so verify-time ranking only saw the high-volume rules and the
-			// most-specific block rule for the request never reached the
-			// JS-side specificity sort.
 			const ruleKeys = await aggregateRedisKeys(
 				this.client,
 				query,
 				this.logger,
 				undefined,
-				FIND_RULES_MAX_CANDIDATES,
+				GREEDY_MAX_CANDIDATES,
 			);
 
 			if (ruleKeys.length === 0) {
@@ -111,7 +277,7 @@ export class RedisRulesReader implements AccessRulesReader {
 			}
 
 			this.logger.debug(() => ({
-				msg: "Executed search query",
+				msg: "Executed greedy search query",
 				data: {
 					inspect: util.inspect(
 						{
@@ -139,17 +305,9 @@ export class RedisRulesReader implements AccessRulesReader {
 			this.logger.error(() => ({
 				err: e,
 				data: {
-					inspect: util.inspect(
-						{
-							query: query,
-							filter: filter,
-						},
-						{
-							depth: null,
-						},
-					),
+					inspect: util.inspect({ query, filter }, { depth: null }),
 				},
-				msg: "failed to execute search query",
+				msg: "failed to execute greedy search query",
 			}));
 
 			return [];