pyric 0.0.1 → 0.1.0-alpha.7

package/dist/rules/modules/stdlib/counters.test.json

@@ -0,0 +1,254 @@
+[
+  {
+    "description": "incrementedBy allows exact +1",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "incrementedBy",
+    "wrapOperation": "update",
+    "wrapCallExpr": "incrementedBy('count', 1)",
+    "resource": {
+      "count": 3
+    },
+    "data": {
+      "count": 4
+    }
+  },
+  {
+    "description": "incrementedBy allows exact negative step",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "incrementedBy",
+    "wrapOperation": "update",
+    "wrapCallExpr": "incrementedBy('count', -1)",
+    "resource": {
+      "count": 3
+    },
+    "data": {
+      "count": 2
+    }
+  },
+  {
+    "description": "incrementedBy denies wrong step",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "incrementedBy",
+    "wrapOperation": "update",
+    "wrapCallExpr": "incrementedBy('count', 1)",
+    "resource": {
+      "count": 3
+    },
+    "data": {
+      "count": 5
+    }
+  },
+  {
+    "description": "incrementedBy denies unchanged value",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "incrementedBy",
+    "wrapOperation": "update",
+    "wrapCallExpr": "incrementedBy('count', 1)",
+    "resource": {
+      "count": 3
+    },
+    "data": {
+      "count": 3
+    }
+  },
+  {
+    "description": "changedBy allows delta at min bound",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "changedBy",
+    "wrapOperation": "update",
+    "wrapCallExpr": "changedBy('likes', -1, 1)",
+    "resource": {
+      "likes": 5
+    },
+    "data": {
+      "likes": 4
+    }
+  },
+  {
+    "description": "changedBy allows delta at max bound",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "changedBy",
+    "wrapOperation": "update",
+    "wrapCallExpr": "changedBy('likes', -1, 1)",
+    "resource": {
+      "likes": 5
+    },
+    "data": {
+      "likes": 6
+    }
+  },
+  {
+    "description": "changedBy allows zero delta when range spans zero",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "changedBy",
+    "wrapOperation": "update",
+    "wrapCallExpr": "changedBy('likes', -1, 1)",
+    "resource": {
+      "likes": 5
+    },
+    "data": {
+      "likes": 5
+    }
+  },
+  {
+    "description": "changedBy denies delta above max",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "changedBy",
+    "wrapOperation": "update",
+    "wrapCallExpr": "changedBy('likes', -1, 1)",
+    "resource": {
+      "likes": 5
+    },
+    "data": {
+      "likes": 7
+    }
+  },
+  {
+    "description": "changedBy denies delta below min",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "changedBy",
+    "wrapOperation": "update",
+    "wrapCallExpr": "changedBy('likes', -1, 1)",
+    "resource": {
+      "likes": 5
+    },
+    "data": {
+      "likes": 3
+    }
+  },
+  {
+    "description": "boundedNumber allows int within range on create",
+    "expectation": "ALLOW",
+    "method": "create",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "boundedNumber",
+    "wrapOperation": "create",
+    "wrapCallExpr": "boundedNumber('rating', 1, 5)",
+    "data": {
+      "rating": 3
+    }
+  },
+  {
+    "description": "boundedNumber allows float within range",
+    "expectation": "ALLOW",
+    "method": "create",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "boundedNumber",
+    "wrapOperation": "create",
+    "wrapCallExpr": "boundedNumber('rating', 1, 5)",
+    "data": {
+      "rating": 4.5
+    }
+  },
+  {
+    "description": "boundedNumber allows boundary values",
+    "expectation": "ALLOW",
+    "method": "create",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "boundedNumber",
+    "wrapOperation": "create",
+    "wrapCallExpr": "boundedNumber('rating', 1, 5)",
+    "data": {
+      "rating": 5
+    }
+  },
+  {
+    "description": "boundedNumber denies out-of-range value",
+    "expectation": "DENY",
+    "method": "create",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "boundedNumber",
+    "wrapOperation": "create",
+    "wrapCallExpr": "boundedNumber('rating', 1, 5)",
+    "data": {
+      "rating": 6
+    }
+  },
+  {
+    "description": "boundedNumber denies non-numeric value",
+    "expectation": "DENY",
+    "method": "create",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "boundedNumber",
+    "wrapOperation": "create",
+    "wrapCallExpr": "boundedNumber('rating', 1, 5)",
+    "data": {
+      "rating": "five"
+    }
+  },
+  {
+    "description": "boundedNumber denies missing field (null-on-miss)",
+    "expectation": "DENY",
+    "method": "create",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "boundedNumber",
+    "wrapOperation": "create",
+    "wrapCallExpr": "boundedNumber('rating', 1, 5)",
+    "data": {
+      "other": 1
+    }
+  }
+]

package/dist/rules/modules/stdlib/geometry.rules

@@ -0,0 +1,43 @@
+// Geometry module for movement game validation via config document lookup.
+//
+// Caller must pass the config document data as an explicit parameter.
+// The config doc is read via get() and cached per request — define a
+// config() function in your rules and pass its result to these functions.
+//
+// Config doc schema:
+//   moves[pieceType][fromCell][toCell] = true
+//   jumps[pieceType][fromCell][toCell] = capturedCellName
+//
+// Usage:
+//   import { validSimpleMove, validJumpMove } from 'geometry';
+//
+//   function config() {
+//     return get(/databases/$(database)/documents/gameConfig/checkers).data;
+//   }
+//
+//   allow update: if validSimpleMove(config())
+//     && piecePlaced() && moveIntegrity();
+//
+//   allow update: if validJumpMove(config())
+//     && captureValid() && captureDecrement() && moveIntegrity();
+
+// Validate a simple (non-capture) move via config document lookup.
+// Uses 3-level dynamic nesting: cfg.moves[piece][from][to].
+// piece comes from resource.data (pre-write board) so client can't fake it.
+export function validSimpleMove(cfg) {
+  let mf = request.resource.data.moveFrom;
+  let mt = request.resource.data.moveTo;
+  let piece = resource.data[mf];
+  return cfg.moves[piece][mf][mt] == true;
+}
+
+// Validate a jump (capture) move via config document lookup.
+// cfg.jumps[piece][from][to] returns the expected captured cell name.
+// Caller must separately verify the captured piece is an opponent piece.
+export function validJumpMove(cfg) {
+  let mf = request.resource.data.moveFrom;
+  let mt = request.resource.data.moveTo;
+  let cap = request.resource.data.captured;
+  let piece = resource.data[mf];
+  return cfg.jumps[piece][mf][mt] == cap;
+}

package/dist/rules/modules/stdlib/geometry.test.json

@@ -0,0 +1,200 @@
+[
+  {
+    "description": "validSimpleMove allows valid forward move",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "resource": {
+      "c0r5": "h",
+      "c1r4": "",
+      "currentTurn": "host",
+      "host": "user1"
+    },
+    "data": {
+      "c0r5": "",
+      "c1r4": "h",
+      "moveFrom": "c0r5",
+      "moveTo": "c1r4",
+      "currentTurn": "host",
+      "host": "user1"
+    },
+    "wrapFunction": "validSimpleMove",
+    "wrapOperation": "update",
+    "wrapCallExpr": "validSimpleMove(get(/databases/$(database)/documents/gameConfig/checkers).data)",
+    "functionMocks": [
+      {
+        "function": "get",
+        "path": "gameConfig/checkers",
+        "result": {
+          "moves": {
+            "h": {
+              "c0r5": {
+                "c1r4": true
+              }
+            }
+          },
+          "jumps": {
+            "h": {
+              "c2r5": {
+                "c0r3": "c1r4"
+              }
+            }
+          }
+        }
+      }
+    ]
+  },
+  {
+    "description": "validSimpleMove denies invalid move (not in config)",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "resource": {
+      "c0r5": "h",
+      "c3r2": "",
+      "currentTurn": "host",
+      "host": "user1"
+    },
+    "data": {
+      "c0r5": "",
+      "c3r2": "h",
+      "moveFrom": "c0r5",
+      "moveTo": "c3r2",
+      "currentTurn": "host",
+      "host": "user1"
+    },
+    "wrapFunction": "validSimpleMove",
+    "wrapOperation": "update",
+    "wrapCallExpr": "validSimpleMove(get(/databases/$(database)/documents/gameConfig/checkers).data)",
+    "functionMocks": [
+      {
+        "function": "get",
+        "path": "gameConfig/checkers",
+        "result": {
+          "moves": {
+            "h": {
+              "c0r5": {
+                "c1r4": true
+              }
+            }
+          },
+          "jumps": {
+            "h": {
+              "c2r5": {
+                "c0r3": "c1r4"
+              }
+            }
+          }
+        }
+      }
+    ]
+  },
+  {
+    "description": "validJumpMove allows valid jump with correct captured cell",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "resource": {
+      "c2r5": "h",
+      "c1r4": "g",
+      "c0r3": "",
+      "currentTurn": "host",
+      "host": "user1"
+    },
+    "data": {
+      "c2r5": "",
+      "c1r4": "",
+      "c0r3": "h",
+      "moveFrom": "c2r5",
+      "moveTo": "c0r3",
+      "captured": "c1r4",
+      "currentTurn": "host",
+      "host": "user1"
+    },
+    "wrapFunction": "validJumpMove",
+    "wrapOperation": "update",
+    "wrapCallExpr": "validJumpMove(get(/databases/$(database)/documents/gameConfig/checkers).data)",
+    "functionMocks": [
+      {
+        "function": "get",
+        "path": "gameConfig/checkers",
+        "result": {
+          "moves": {
+            "h": {
+              "c0r5": {
+                "c1r4": true
+              }
+            }
+          },
+          "jumps": {
+            "h": {
+              "c2r5": {
+                "c0r3": "c1r4"
+              }
+            }
+          }
+        }
+      }
+    ]
+  },
+  {
+    "description": "validJumpMove denies jump with wrong captured cell",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "resource": {
+      "c2r5": "h",
+      "c1r4": "g",
+      "c0r3": "",
+      "currentTurn": "host",
+      "host": "user1"
+    },
+    "data": {
+      "c2r5": "",
+      "c1r4": "",
+      "c0r3": "h",
+      "moveFrom": "c2r5",
+      "moveTo": "c0r3",
+      "captured": "c3r4",
+      "currentTurn": "host",
+      "host": "user1"
+    },
+    "wrapFunction": "validJumpMove",
+    "wrapOperation": "update",
+    "wrapCallExpr": "validJumpMove(get(/databases/$(database)/documents/gameConfig/checkers).data)",
+    "functionMocks": [
+      {
+        "function": "get",
+        "path": "gameConfig/checkers",
+        "result": {
+          "moves": {
+            "h": {
+              "c0r5": {
+                "c1r4": true
+              }
+            }
+          },
+          "jumps": {
+            "h": {
+              "c2r5": {
+                "c0r3": "c1r4"
+              }
+            }
+          }
+        }
+      }
+    ]
+  }
+]

package/dist/rules/modules/stdlib/joining.rules

@@ -0,0 +1,49 @@
+// Joining module — how membership CHANGES, safely. The connective
+// tissue between content/spaces: spaces gates children behind a
+// members field; joining lets users enter and leave that field
+// WITHOUT an admin backend, with no privilege escalation.
+//
+// Convention: a MAP-shaped members field (uid -> role) on the parent
+// doc. Compose with lifecycle's onlyFieldsChanged so a join/leave
+// write can't touch anything else:
+//
+//   import { onlyAddedSelf, onlyRemovedSelf } from 'joining';
+//   import { onlyFieldsChanged } from 'lifecycle';
+//   import { isSpaceMember, hasSpaceRole } from 'spaces';
+//
+//   match /teams/{teamId} {
+//     allow read: if isSpaceMember(resource.data);
+//
+//     // Open self-service join (public team) at a fixed role, and
+//     // self-service leave — nothing else about the doc may change:
+//     allow update: if onlyFieldsChanged(['members'])
+//       && (onlyAddedSelf('members', 'editor') || onlyRemovedSelf('members'));
+//     // Admins manage the doc freely:
+//     allow update: if hasSpaceRole(resource.data, 'admin');
+//   }
+//
+// Every guarantee here is production-verified against the live Rules Test API:
+// the field-level map diff is reliable; the empty no-op diff DENIES (set
+// equality, not hasOnly — hasOnly on an empty set passes); role escalation via
+// CHANGING an existing entry denies; adding or removing anyone else denies.
+
+// The write adds EXACTLY the caller to the members map, at EXACTLY
+// `role`, changing and removing nobody. Update rules only.
+export function onlyAddedSelf(membersField, role) {
+  let diff = request.resource.data[membersField].diff(resource.data[membersField]);
+  return request.auth != null
+    && diff.addedKeys() == [request.auth.uid].toSet()
+    && diff.changedKeys().size() == 0
+    && diff.removedKeys().size() == 0
+    && request.resource.data[membersField][request.auth.uid] == role;
+}
+
+// The write removes EXACTLY the caller from the members map, adding
+// and changing nobody. Self-service leave. Update rules only.
+export function onlyRemovedSelf(membersField) {
+  let diff = request.resource.data[membersField].diff(resource.data[membersField]);
+  return request.auth != null
+    && diff.removedKeys() == [request.auth.uid].toSet()
+    && diff.addedKeys().size() == 0
+    && diff.changedKeys().size() == 0;
+}