pyric 0.0.1 → 0.1.0-alpha.7

package/dist/rules/modules/stdlib/joining.test.json

@@ -0,0 +1,287 @@
+[
+  {
+    "description": "onlyAddedSelf allows adding exactly yourself at the granted role",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "carol"
+    },
+    "resource": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "data": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor",
+        "carol": "editor"
+      }
+    },
+    "wrapFunction": "onlyAddedSelf",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyAddedSelf('members', 'editor')"
+  },
+  {
+    "description": "onlyAddedSelf denies self-granting a different role",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "carol"
+    },
+    "resource": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "data": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor",
+        "carol": "admin"
+      }
+    },
+    "wrapFunction": "onlyAddedSelf",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyAddedSelf('members', 'editor')"
+  },
+  {
+    "description": "onlyAddedSelf denies adding yourself plus someone else",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "carol"
+    },
+    "resource": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "data": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor",
+        "carol": "editor",
+        "dave": "editor"
+      }
+    },
+    "wrapFunction": "onlyAddedSelf",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyAddedSelf('members', 'editor')"
+  },
+  {
+    "description": "onlyAddedSelf denies changing another member's role while joining",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "carol"
+    },
+    "resource": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "data": {
+      "name": "team",
+      "members": {
+        "alice": "editor",
+        "bob": "editor",
+        "carol": "editor"
+      }
+    },
+    "wrapFunction": "onlyAddedSelf",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyAddedSelf('members', 'editor')"
+  },
+  {
+    "description": "onlyAddedSelf denies removing a member while joining",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "carol"
+    },
+    "resource": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "data": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "carol": "editor"
+      }
+    },
+    "wrapFunction": "onlyAddedSelf",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyAddedSelf('members', 'editor')"
+  },
+  {
+    "description": "onlyAddedSelf denies a no-op members write (empty diff)",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "alice"
+    },
+    "resource": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "data": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "wrapFunction": "onlyAddedSelf",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyAddedSelf('members', 'editor')"
+  },
+  {
+    "description": "onlyAddedSelf denies an existing member escalating their own role",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "bob"
+    },
+    "resource": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "data": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "admin"
+      }
+    },
+    "wrapFunction": "onlyAddedSelf",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyAddedSelf('members', 'editor')"
+  },
+  {
+    "description": "onlyRemovedSelf allows removing exactly yourself",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "bob"
+    },
+    "resource": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "data": {
+      "name": "team",
+      "members": {
+        "alice": "admin"
+      }
+    },
+    "wrapFunction": "onlyRemovedSelf",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyRemovedSelf('members')"
+  },
+  {
+    "description": "onlyRemovedSelf denies removing someone else",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "bob"
+    },
+    "resource": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "data": {
+      "name": "team",
+      "members": {
+        "bob": "editor"
+      }
+    },
+    "wrapFunction": "onlyRemovedSelf",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyRemovedSelf('members')"
+  },
+  {
+    "description": "onlyRemovedSelf denies a stranger removing a member",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "mallory"
+    },
+    "resource": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "data": {
+      "name": "team",
+      "members": {
+        "alice": "admin"
+      }
+    },
+    "wrapFunction": "onlyRemovedSelf",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyRemovedSelf('members')"
+  },
+  {
+    "description": "onlyRemovedSelf denies removing yourself AND another member",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "bob"
+    },
+    "resource": {
+      "name": "team",
+      "members": {
+        "alice": "admin",
+        "bob": "editor"
+      }
+    },
+    "data": {
+      "name": "team",
+      "members": {}
+    },
+    "wrapFunction": "onlyRemovedSelf",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyRemovedSelf('members')"
+  }
+]

package/dist/rules/modules/stdlib/lifecycle.rules

@@ -0,0 +1,51 @@
+// Lifecycle module for field immutability and timestamp enforcement.
+//
+// Common pattern: certain fields must never change after document creation
+// (createdBy, createdAt, authorId).
+//
+// Usage:
+//   import { fieldUnchanged, immutableFields, isServerTimestamp } from 'lifecycle';
+//
+//   // Single field:
+//   allow update: if fieldUnchanged('createdBy');
+//
+//   // Multiple fields (replaces chained fieldUnchanged calls):
+//   allow update: if immutableFields(['createdBy', 'createdAt', 'authorId']);
+//
+//   // The dual: users may edit title/body but NOTHING else:
+//   allow update: if onlyFieldsChanged(['title', 'body']);
+//
+//   allow create: if isServerTimestamp('createdAt');
+
+// Ensure a field's value is identical between existing and incoming document.
+// Use on update rules to enforce immutability.
+export function fieldUnchanged(field) {
+  return resource.data[field] == request.resource.data[field];
+}
+
+// Ensure multiple fields are unchanged between existing and incoming document.
+// Uses MapDiff — one expression instead of N chained fieldUnchanged() calls.
+export function immutableFields(fields) {
+  return request.resource.data.diff(resource.data).unchangedKeys().hasAll(fields);
+}
+
+// Ensure a field is set to the server timestamp.
+// Use on create or update rules to enforce server-side time.
+export function isServerTimestamp(field) {
+  return request.resource.data[field] == request.time;
+}
+
+// The dual of immutableFields: every changed field is in the allowed
+// list (fields NOT listed are implicitly immutable). Top-level keys
+// only — nested-map diffs are unreliable in production; flatten the
+// schema instead of reaching for a nested diff.
+export function onlyFieldsChanged(fields) {
+  return request.resource.data.diff(resource.data).affectedKeys().hasOnly(fields);
+}
+
+// Exactly n top-level fields changed in this write. n == 1 is the
+// board-integrity / edit-one-field-per-write guard (Pattern 5,
+// generalized beyond games).
+export function nFieldsChanged(n) {
+  return request.resource.data.diff(resource.data).affectedKeys().size() == n;
+}

package/dist/rules/modules/stdlib/lifecycle.test.json

@@ -0,0 +1,288 @@
+[
+  {
+    "description": "fieldUnchanged allows when field value is same",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "resource": {
+      "createdBy": "user1",
+      "title": "old"
+    },
+    "data": {
+      "createdBy": "user1",
+      "title": "new"
+    },
+    "wrapFunction": "fieldUnchanged",
+    "wrapOperation": "update",
+    "wrapCallExpr": "fieldUnchanged('createdBy')"
+  },
+  {
+    "description": "fieldUnchanged denies when field value changed",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "resource": {
+      "createdBy": "user1",
+      "title": "old"
+    },
+    "data": {
+      "createdBy": "user2",
+      "title": "new"
+    },
+    "wrapFunction": "fieldUnchanged",
+    "wrapOperation": "update",
+    "wrapCallExpr": "fieldUnchanged('createdBy')"
+  },
+  {
+    "description": "fieldUnchanged works with timestamp fields",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "resource": {
+      "createdAt": "2024-01-01T00:00:00Z",
+      "title": "old"
+    },
+    "data": {
+      "createdAt": "2024-01-01T00:00:00Z",
+      "title": "new"
+    },
+    "wrapFunction": "fieldUnchanged",
+    "wrapOperation": "update",
+    "wrapCallExpr": "fieldUnchanged('createdAt')"
+  },
+  {
+    "description": "immutableFields allows when all listed fields unchanged",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "resource": {
+      "createdBy": "user1",
+      "ownerId": "user1",
+      "title": "old"
+    },
+    "data": {
+      "createdBy": "user1",
+      "ownerId": "user1",
+      "title": "new"
+    },
+    "wrapFunction": "immutableFields",
+    "wrapOperation": "update",
+    "wrapCallExpr": "immutableFields(['createdBy', 'ownerId'])"
+  },
+  {
+    "description": "immutableFields denies when one listed field changed",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "resource": {
+      "createdBy": "user1",
+      "ownerId": "user1",
+      "title": "old"
+    },
+    "data": {
+      "createdBy": "hacker",
+      "ownerId": "user1",
+      "title": "new"
+    },
+    "wrapFunction": "immutableFields",
+    "wrapOperation": "update",
+    "wrapCallExpr": "immutableFields(['createdBy', 'ownerId'])"
+  },
+  {
+    "description": "isServerTimestamp allows when field equals request.time",
+    "expectation": "ALLOW",
+    "method": "create",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "data": {
+      "createdAt": "REQUEST_TIME",
+      "title": "hello"
+    },
+    "wrapFunction": "isServerTimestamp",
+    "wrapOperation": "create",
+    "wrapCallExpr": "isServerTimestamp('createdAt')"
+  },
+  {
+    "description": "onlyFieldsChanged allows when only listed fields changed",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "onlyFieldsChanged",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyFieldsChanged(['title', 'body'])",
+    "resource": {
+      "title": "old",
+      "body": "old",
+      "author": "user1"
+    },
+    "data": {
+      "title": "new",
+      "body": "new",
+      "author": "user1"
+    }
+  },
+  {
+    "description": "onlyFieldsChanged allows a subset of listed fields changing",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "onlyFieldsChanged",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyFieldsChanged(['title', 'body'])",
+    "resource": {
+      "title": "old",
+      "body": "same",
+      "author": "user1"
+    },
+    "data": {
+      "title": "new",
+      "body": "same",
+      "author": "user1"
+    }
+  },
+  {
+    "description": "onlyFieldsChanged denies when an unlisted field changed",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "onlyFieldsChanged",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyFieldsChanged(['title', 'body'])",
+    "resource": {
+      "title": "old",
+      "body": "old",
+      "author": "user1"
+    },
+    "data": {
+      "title": "new",
+      "body": "old",
+      "author": "attacker"
+    }
+  },
+  {
+    "description": "onlyFieldsChanged denies when an unlisted field is ADDED",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "onlyFieldsChanged",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyFieldsChanged(['title'])",
+    "resource": {
+      "title": "old"
+    },
+    "data": {
+      "title": "new",
+      "admin": true
+    }
+  },
+  {
+    "description": "onlyFieldsChanged denies when an unlisted field is REMOVED",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "onlyFieldsChanged",
+    "wrapOperation": "update",
+    "wrapCallExpr": "onlyFieldsChanged(['title'])",
+    "resource": {
+      "title": "old",
+      "author": "user1"
+    },
+    "data": {
+      "title": "new"
+    }
+  },
+  {
+    "description": "nFieldsChanged allows when exactly one field changed",
+    "expectation": "ALLOW",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "nFieldsChanged",
+    "wrapOperation": "update",
+    "wrapCallExpr": "nFieldsChanged(1)",
+    "resource": {
+      "c1": "x",
+      "c2": "",
+      "turn": "host"
+    },
+    "data": {
+      "c1": "x",
+      "c2": "o",
+      "turn": "host"
+    }
+  },
+  {
+    "description": "nFieldsChanged denies when two fields changed",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "nFieldsChanged",
+    "wrapOperation": "update",
+    "wrapCallExpr": "nFieldsChanged(1)",
+    "resource": {
+      "c1": "x",
+      "c2": "",
+      "turn": "host"
+    },
+    "data": {
+      "c1": "",
+      "c2": "o",
+      "turn": "host"
+    }
+  },
+  {
+    "description": "nFieldsChanged denies when zero fields changed",
+    "expectation": "DENY",
+    "method": "update",
+    "path": "test/doc1",
+    "auth": {
+      "uid": "user1"
+    },
+    "wrapFunction": "nFieldsChanged",
+    "wrapOperation": "update",
+    "wrapCallExpr": "nFieldsChanged(1)",
+    "resource": {
+      "c1": "x"
+    },
+    "data": {
+      "c1": "x"
+    }
+  }
+]

package/dist/rules/modules/stdlib/lobby.rules

@@ -0,0 +1,44 @@
+// Lobby module for 2-participant coordination.
+//
+// Convention: documents must have these fields:
+//   host: string (creator's UID)
+//   guest: string ('' when waiting, joiner's UID when joined)
+//   status: 'waiting' | 'playing' | 'ready' (or any active state)
+//
+// Usage:
+//   import { validCreate, validJoin, canCancel } from 'lobby';
+//
+//   allow create: if validCreate();
+//   allow update: if validJoin();
+//   allow delete: if canCancel();
+
+// Is this a waiting lobby with an open seat?
+function isWaiting() {
+  return resource.data.status == 'waiting'
+    && resource.data.guest == '';
+}
+
+// Create: caller is host, seat empty, status waiting
+export function validCreate() {
+  return request.auth != null
+    && request.resource.data.host == request.auth.uid
+    && request.resource.data.guest == ''
+    && request.resource.data.status == 'waiting';
+}
+
+// Join: fill empty seat, transition to next status, no self-join
+export function validJoin() {
+  return request.auth != null
+    && isWaiting()
+    && request.resource.data.guest == request.auth.uid
+    && request.auth.uid != resource.data.host
+    && request.resource.data.status == 'playing'
+    && request.resource.data.host == resource.data.host;
+}
+
+// Cancel: only host, only while waiting
+export function canCancel() {
+  return request.auth != null
+    && resource.data.status == 'waiting'
+    && request.auth.uid == resource.data.host;
+}

package/dist/rules/modules/stdlib/lobby.test.json

@@ -0,0 +1,32 @@
+[
+  {
+    "description": "validCreate allows host to open lobby",
+    "expectation": "ALLOW",
+    "method": "create",
+    "path": "test/room1",
+    "auth": { "uid": "host1" },
+    "data": { "host": "host1", "guest": "", "status": "waiting" },
+    "wrapFunction": "validCreate",
+    "wrapOperation": "create"
+  },
+  {
+    "description": "validCreate denies impersonation",
+    "expectation": "DENY",
+    "method": "create",
+    "path": "test/room1",
+    "auth": { "uid": "attacker" },
+    "data": { "host": "host1", "guest": "", "status": "waiting" },
+    "wrapFunction": "validCreate",
+    "wrapOperation": "create"
+  },
+  {
+    "description": "validCreate denies pre-filled guest",
+    "expectation": "DENY",
+    "method": "create",
+    "path": "test/room1",
+    "auth": { "uid": "host1" },
+    "data": { "host": "host1", "guest": "sneaky", "status": "waiting" },
+    "wrapFunction": "validCreate",
+    "wrapOperation": "create"
+  }
+]