simple-authz 1.0.5 → 1.2.0

package/lib/rules/parser.js

@@ -1,38 +1,88 @@
 const fs = require("fs")
 
+const KNOWN_KEYS = ["role", "action", "resource", "condition"]
+
 function parseRules(filePath) {
 
     const content = fs.readFileSync(filePath, "utf8")
-
-    const lines = content.split("\n").map(l => l.trim())
+    const rawLines = content.split("\n")
 
     const rules = []
     let current = null
+    let ruleStartLine = null
+
+    rawLines.forEach((rawLine, idx) => {
 
-    for (const line of lines) {
+        const lineNumber = idx + 1
+        const line = rawLine.trim()
 
-        if (!line || line.startsWith("#")) continue
+        if (!line || line.startsWith("#")) return
 
         if (line === "rule") {
+
+            // Previously this silently overwrote `current`, discarding an
+            // already-open rule block that was missing its "end".
+            if (current) {
+                throw new Error(
+                    `Policy parse error at line ${lineNumber}: found "rule" but the ` +
+                    `rule opened at line ${ruleStartLine} is still unclosed (missing "end").`
+                )
+            }
+
             current = {}
+            ruleStartLine = lineNumber
+            return
         }
 
-        else if (line === "end") {
+        if (line === "end") {
+
+            // Previously this pushed `current` (= null for a stray "end")
+            // straight into `rules`, which crashed later in validateRules
+            // with an unhelpful "Cannot read properties of null".
+            if (!current) {
+                throw new Error(
+                    `Policy parse error at line ${lineNumber}: found "end" with no matching "rule".`
+                )
+            }
+
             rules.push(current)
             current = null
+            ruleStartLine = null
+            return
         }
 
-        else if (current) {
+        if (!current) {
+            throw new Error(
+                `Policy parse error at line ${lineNumber}: "${line}" appears outside ` +
+                `of a rule/end block.`
+            )
+        }
 
-            const [key, ...rest] = line.split(" ")
-            const value = rest.join(" ")
+        const [key, ...rest] = line.split(" ")
+        const value = rest.join(" ")
 
-            if (key === "role") current.role = value
-            if (key === "action") current.action = value
-            if (key === "resource") current.resource = value
-            if (key === "condition") current.condition = value
+        // Previously an unrecognized key (e.g. "roel" typo'd for "role")
+        // was silently dropped, leaving the rule incomplete with no warning.
+        if (!KNOWN_KEYS.includes(key)) {
+            throw new Error(
+                `Policy parse error at line ${lineNumber}: unknown key "${key}" ` +
+                `(expected one of: ${KNOWN_KEYS.join(", ")}).`
+            )
+        }
 
+        if (!value) {
+            throw new Error(
+                `Policy parse error at line ${lineNumber}: "${key}" has no value.`
+            )
         }
+
+        current[key] = value
+    })
+
+    if (current) {
+        throw new Error(
+            `Policy parse error: rule opened at line ${ruleStartLine} was never closed with "end".`
+        )
     }
 
     return rules

package/lib/rules/validator.js

@@ -1,3 +1,5 @@
+const { compileCondition } = require("../engine/conditionCompiler")
+
 function validateRules(rules) {
 
     const errors = []
@@ -20,17 +22,21 @@ function validateRules(rules) {
 
         if (rule.condition) {
 
-            const validOperators = [
-                "==", "!=", ">", "<", ">=", "<="
-            ]
-
-            const hasOperator = validOperators.some(op =>
-                rule.condition.includes(op)
-            )
-
-            if (!hasOperator) {
+            // Previously this only checked whether an operator substring
+            // (e.g. "==") appeared ANYWHERE in the condition text — it never
+            // actually verified the condition parses. A condition like
+            // "doc.status ==" (missing right-hand side) or one with mismatched
+            // AND/OR usage would pass this check and then either crash later
+            // deep inside the compiler with no rule number attached, or (worse)
+            // silently compile into a broken/always-false comparison.
+            //
+            // Actually attempting to compile it here catches real structural
+            // problems immediately, at the rule they belong to.
+            try {
+                compileCondition(rule.condition)
+            } catch (err) {
                 errors.push(
-                    `Rule ${ruleNumber}: invalid condition "${rule.condition}"`
+                    `Rule ${ruleNumber}: invalid condition "${rule.condition}" — ${err.message}`
                 )
             }
         }

package/package.json

@@ -1,36 +1,52 @@
-{
-  "name": "simple-authz",
-  "version": "1.0.5",
-  "description": "Lightweight policy-based authorization engine for Node.js using TOON policy language",
-  "main": "lib/index.js",
-  "scripts": {
-    "test": "node bin/test.js",
-    "dev": "node lib/core/authz.js"
-  },
-  "keywords": [
-    "authorization",
-    "access-control",
-    "auth",
-    "policy-engine",
-    "rbac",
-    "abac",
-    "permissions",
-    "nodejs-auth",
-    "authorization-library",
-    "security",
-    "policy-based-access",
-    "authz",
-    "role-based-access-control",
-    "authorization-engine"
-  ],
-  "author": "Dhruvil",
-  "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/dhruvil05/simple-authz"
-  },
-  "bugs": {
-    "url": "https://github.com/dhruvil05/simple-authz/issues"
-  },
-  "homepage": "https://github.com/dhruvil05/simple-authz#readme"
-}
+{
+  "name": "simple-authz",
+  "version": "1.2.0",
+  "description": "Lightweight policy-based authorization engine for Node.js using TOON policy language",
+  "main": "lib/index.js",
+  "scripts": {
+    "test": "jest",
+    "dev": "node lib/core/authz.js"
+  },
+  "bin": {
+    "simple-authz": "bin/simple-authz/index.js"
+  },
+  "dependencies": {
+    "chalk": "^4.1.2",
+    "commander": "^11.0.0"
+  },
+  "devDependencies": {
+    "jest": "^30.3.0"
+  },
+  "keywords": [
+    "authorization",
+    "access-control",
+    "auth",
+    "policy-engine",
+    "rbac",
+    "abac",
+    "permissions",
+    "nodejs-auth",
+    "authorization-library",
+    "security",
+    "policy-based-access",
+    "authz",
+    "role-based-access-control",
+    "authorization-engine"
+  ],
+  "types": "types/index.d.ts",
+  "files": [
+    "lib/",
+    "types/",
+    "package.json"
+  ],
+  "author": "Dhruvil",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dhruvil05/simple-authz"
+  },
+  "bugs": {
+    "url": "https://github.com/dhruvil05/simple-authz/issues"
+  },
+  "homepage": "https://github.com/dhruvil05/simple-authz#readme"
+}

package/types/index.d.ts

@@ -0,0 +1,31 @@
+declare module "simple-authz" {
+  interface User {
+    role?: string;
+    roles?: string[];
+    [key: string]: any;
+  }
+
+  interface ExplainResult {
+    allowed: boolean;
+    role?: string;
+    resource?: string;
+    action?: string;
+    reason: string;
+    condition?: any;
+  }
+
+  class Authz {
+    load(path: string): void;
+    can(user: User, action: string, resource: string, data?: any): boolean;
+    explain(
+      user: User,
+      action: string,
+      resource: string,
+      data?: any,
+    ): ExplainResult;
+    middleware(action: string, resource: string): any;
+  }
+
+  const authz: Authz;
+  export = authz;
+}