simple-authz 1.1.0 → 1.2.0

package/README.md

@@ -1,23 +1,5 @@
-Your README is already strong — we just need to **upgrade it to reflect v1.1.0 features** without breaking its structure.
-
-I’ll **edit and improve your version**, not rewrite from scratch.
-
----
-
-# ✅ Updated README (v1.1.0 Improvements Applied)
-
-Below is your improved version with:
-
-* ✔ middleware added
-* ✔ caching mentioned
-* ✔ TypeScript support
-* ✔ `authz.explain()` refined
-* ✔ Quick Start fixed (you exported instance, not class ⚠️)
-* ✔ small clarity + professionalism upgrades
-
 ---
 
-````markdown
 # Simple Authz
 
 A lightweight and flexible **authorization engine for Node.js** built around a simple policy language called **TOON (Token-Oriented Object Notation)**.
@@ -70,7 +52,7 @@ Most applications implement authorization like this:
 if(user.role === "admin") { ... }
 if(user.id === listing.owner_id) { ... }
 if(user.permissions.includes("edit_listing")) { ... }
-````
+```
 
 Over time this logic spreads across many files and becomes difficult to maintain.
 
@@ -207,6 +189,26 @@ app.post(
 );
 ```
 
+> ⚠️ **Security note:** by default the middleware checks against `req.body`.
+> That's fine for actions where the body *is* the thing being created, but
+> if your policy has conditions like `listing.owner_id == user.id`, a client
+> can put whatever `owner_id` it wants in its own request body and bypass
+> the check. Pass a third argument — an (optionally async) function that
+> loads the **real** resource from your database — whenever a condition
+> depends on data the client shouldn't be trusted to supply:
+>
+> ```javascript
+> app.post(
+>   "/listing/:id",
+>   authz.middleware("edit", "listing", async (req) => {
+>     return await db.listings.findById(req.params.id);
+>   }),
+>   (req, res) => {
+>     res.send("Allowed");
+>   }
+> );
+> ```
+
 ---
 
 # Core Concepts
@@ -235,6 +237,15 @@ rule
 end
 ```
 
+The parser is strict on purpose: a stray `end`, a `rule` opened twice without
+closing it, an unrecognized key (e.g. a typo'd `roel`), or a key with no
+value all throw a clear error with the line number, instead of silently
+dropping or mis-parsing part of your policy. `authz.load()` runs full
+validation too — every condition is actually compiled during validation, so
+a broken condition (missing operand, mixed `AND`/`OR`, etc.) is reported
+against its rule number at load time rather than failing later, mid-request,
+somewhere inside the evaluator.
+
 ---
 
 # Wildcards
@@ -254,6 +265,18 @@ Example:
 condition listing.owner_id == user.id AND listing.status != "published"
 ```
 
+Chains of any length work: `a == 1 AND b == 2 AND c == 3`. You can also
+compare against numbers and booleans directly (`listing.views > 100`), not
+just strings.
+
+Only one operator type per condition — `AND` and `OR` can't be mixed in the
+same condition (`a == 1 AND b == 2 OR c == 3` throws an error). Split that
+into two separate rules instead.
+
+String literals are quote-safe: a value like
+`doc.title == "Terms AND Conditions"` is treated as one literal, not
+accidentally split on the "AND" inside it.
+
 ---
 
 # Policy Examples
@@ -341,7 +364,33 @@ project/
 * Rules compiled into indexed structure
 * AST-based condition evaluation
 * O(1) permission lookup
-* Built-in caching layer
+* Built-in LRU cache with TTL-based expiration, keyed by user + action +
+  resource + object id (falls back to a data snapshot if there's no id)
+
+**Caching caveat:** because the cache keys on object *identity* (id/owner_id),
+if a resource's *other* fields change while its id stays the same (e.g. a
+document gets locked) within the TTL window, a stale decision can be served.
+Call `authz.clearCache()` right after any write that could flip a condition's
+outcome, or lower `cacheTTL` / set `cacheEnabled: false` for policies with
+conditions on fast-changing fields:
+
+```javascript
+const authz = new Authz({ cacheEnabled: true, cacheSize: 1000, cacheTTL: 60 });
+```
+
+---
+
+# CLI
+
+```bash
+npx simple-authz validate ./policies/authz.toon
+npx simple-authz check ./policies/authz.toon --user '{"id":1,"roles":["user"]}' --action edit --resource listing --context '{"owner_id":1}'
+npx simple-authz benchmark ./policies/authz.toon --iterations 10000
+```
+
+* `validate` — parses and validates a policy file, lists roles found
+* `check` — runs `authz.explain()` against a policy and prints the decision
+* `benchmark` — runs repeated checks and prints throughput + cache stats
 
 ---
 
@@ -360,7 +409,6 @@ rule exists → allow
 
 ### v1.2
 
-* CLI tool
 * Role hierarchy
 * Modular policies
 
@@ -384,11 +432,4 @@ rule exists → allow
 
 Apache 2.0
 
----
-
-# Keywords
-
-authorization, rbac, abac, nodejs, security, policy-engine
-
-````
-
+---

package/bin/simple-authz/index.js

@@ -0,0 +1,132 @@
+#!/usr/bin/env node
+
+const { program } = require('commander');
+const Authz = require('../../lib/core/authz');
+const chalk = require('chalk'); // for colored output
+const path = require('path');
+
+program.version('1.1.0');
+
+program
+    .command('validate <policyFile>')
+    .description('Validate a TOON policy file')
+    .action((policyFile) => {
+        try {
+            const authz = new Authz();
+            authz.load(policyFile);
+
+            const rules = authz.getRules();
+            console.log(chalk.green('✓ Policy file is valid\n'));
+            console.log(`  File: ${chalk.gray(path.resolve(policyFile))}`);
+            console.log(`  Rules loaded: ${chalk.blue(rules.length)}`);
+            console.log(`  Roles: ${chalk.blue([...new Set(rules.map(r => r.role))].join(', '))}`);
+            console.log();
+        } catch (err) {
+            console.error(chalk.red('✗ Validation failed\n'));
+            console.error(`  ${chalk.red(err.message)}`);
+            process.exit(1);
+        }
+    });
+
+program
+    .command('check <policyFile>')
+    .requiredOption('--user <json>', 'User object as JSON')
+    .requiredOption('--action <action>', 'Action to check')
+    .requiredOption('--resource <resource>', 'Resource type')
+    .option('--context <json>', 'Context/object as JSON')
+    .description('Test an authorization decision')
+    .action((policyFile, options) => {
+        try {
+            const authz = new Authz({ debugMode: true });
+            authz.load(policyFile);
+
+            const user = JSON.parse(options.user);
+            const context = options.context ? JSON.parse(options.context) : {};
+
+            const result = authz.explain(user, options.action, options.resource, context);
+
+            console.log();
+            if (result.allowed) {
+                console.log(chalk.green('✓ ALLOWED\n'));
+            } else {
+                console.log(chalk.red('✗ DENIED\n'));
+            }
+
+            const userRoles = user.roles || (user.role ? [user.role] : []);
+
+            console.log(`  User ID:        ${chalk.blue(user.id)}`);
+            console.log(`  User roles:     ${chalk.blue(userRoles.join(', '))}`);
+            console.log(`  Action:         ${chalk.blue(options.action)}`);
+            console.log(`  Resource:       ${chalk.blue(options.resource)}`);
+            console.log(`  Reason:         ${chalk.yellow(result.reason)}`);
+
+            if (result.ruleMatched) {
+                console.log(`  Rule matched:   ${chalk.green(result.ruleMatched)}`);
+            }
+            if (result.evaluationTime) {
+                console.log(`  Eval time:      ${chalk.gray(result.evaluationTime + 'ms')}`);
+            }
+            console.log();
+
+            process.exit(result.allowed ? 0 : 1);
+        } catch (err) {
+            console.error(chalk.red('✗ Check failed\n'));
+            console.error(`  ${chalk.red(err.message)}`);
+            process.exit(1);
+        }
+    });
+
+program
+    .command('benchmark <policyFile>')
+    .option('--iterations <n>', 'Number of checks to run', '10000')
+    .description('Benchmark authorization performance')
+    .action((policyFile, options) => {
+        const iterations = parseInt(options.iterations);
+
+        try {
+            const authz = new Authz({ cacheEnabled: true });
+            authz.load(policyFile);
+
+            const user = { id: 1, roles: ['admin', 'user'] };
+            const object = { owner_id: 1, status: 'active' };
+
+            // Warmup
+            for (let i = 0; i < 10; i++) {
+                authz.can(user, 'edit', 'resource', object);
+            }
+
+            // Benchmark
+            const start = process.hrtime.bigint();
+            for (let i = 0; i < iterations; i++) {
+                authz.can(user, 'edit', 'resource', object);
+            }
+            const end = process.hrtime.bigint();
+
+            const timeMs = Number(end - start) / 1_000_000;
+            const checksPerSec = Math.round((iterations / timeMs) * 1000);
+
+            console.log();
+            console.log(chalk.cyan('Performance Benchmark'));
+            console.log('─'.repeat(40));
+            console.log(`  Iterations:    ${chalk.blue(iterations.toLocaleString())}`);
+            console.log(`  Total time:    ${chalk.blue(timeMs.toFixed(2))} ms`);
+            console.log(`  Avg per check: ${chalk.blue((timeMs / iterations).toFixed(4))} ms`);
+            console.log(`  Checks/sec:    ${chalk.green(checksPerSec.toLocaleString())}`);
+
+            const stats = authz.cacheStats();
+            console.log();
+            console.log(chalk.cyan('Cache Statistics'));
+            console.log('─'.repeat(40));
+            console.log(`  Hit rate:      ${chalk.blue(stats.hitRate)}`);
+            console.log(`  Cache size:    ${chalk.blue(stats.size)}/${stats.maxSize}`);
+            console.log(`  Hits:          ${chalk.green(stats.hits.toLocaleString())}`);
+            console.log(`  Misses:        ${chalk.yellow(stats.misses.toLocaleString())}`);
+            console.log();
+        } catch (err) {
+            console.error(chalk.red('✗ Benchmark failed\n'));
+            console.error(`  ${chalk.red(err.message)}`);
+            process.exit(1);
+        }
+    });
+
+program.parse();

package/lib/cache.js

@@ -12,7 +12,12 @@ class AuthzCache {
         this.enabled = options.enabled !== false;
 
         this.cache = new Map();
-        this.stats = {
+        // Named _stats (not `stats`) because a class method `stats()` exists
+        // below — an instance property named the same as a prototype method
+        // shadows it, so `cache.stats()` would throw "not a function" the
+        // moment anyone actually called it (this went uncaught only because
+        // the cache itself was never wired into Authz until now).
+        this._stats = {
             hits: 0,
             misses: 0,
             evictions: 0,
@@ -22,10 +27,19 @@ class AuthzCache {
 
     /**
      * Generate cache key from request parameters
-     * Format: {userId}:{action}:{resource}:{objectId or 'null'}
+     * Format: {userIdentity}:{action}:{resource}:{objectId or 'null'}
+     *
+     * Falls back to role(s) when there's no `user.id` — otherwise every
+     * id-less user (e.g. identified only by `user.role`/`user.roles`, which
+     * this library explicitly supports) would collide into the same cache
+     * key and could get served another user's cached decision.
      */
     _key(user, action, resource, objectId) {
-        return `${user.id}:${action}:${resource}:${objectId || 'null'}`;
+        const identity = user && user.id != null
+            ? user.id
+            : `roles:${JSON.stringify((user && (user.roles || user.role)) || null)}`;
+
+        return `${identity}:${action}:${resource}:${objectId || 'null'}`;
     }
 
     /**
@@ -41,7 +55,7 @@ class AuthzCache {
         const entry = this.cache.get(key);
 
         if (!entry) {
-            this.stats.misses++;
+            this._stats.misses++;
             return null;
         }
 
@@ -49,14 +63,14 @@ class AuthzCache {
         const age = (Date.now() - entry.timestamp) / 1000;
         if (age > this.ttl) {
             this.cache.delete(key);
-            this.stats.timeouts++;
-            this.stats.misses++;
+            this._stats.timeouts++;
+            this._stats.misses++;
             return null;
         }
 
         // Hit!
         entry.lastAccess = Date.now();
-        this.stats.hits++;
+        this._stats.hits++;
         return entry.result;
     }
 
@@ -82,7 +96,7 @@ class AuthzCache {
 
             if (oldestKey) {
                 this.cache.delete(oldestKey);
-                this.stats.evictions++;
+                this._stats.evictions++;
             }
         }
 
@@ -102,21 +116,21 @@ class AuthzCache {
     clear() {
         const before = this.cache.size;
         this.cache.clear();
-        return { cleared: before, stats: this.stats };
+        return { cleared: before, stats: this._stats };
     }
 
     /**
      * Get cache statistics
      */
     stats() {
-        const total = this.stats.hits + this.stats.misses;
-        const hitRate = total === 0 ? 0 : ((this.stats.hits / total) * 100).toFixed(2);
+        const total = this._stats.hits + this._stats.misses;
+        const hitRate = total === 0 ? 0 : ((this._stats.hits / total) * 100).toFixed(2);
 
         return {
-            hits: this.stats.hits,
-            misses: this.stats.misses,
-            evictions: this.stats.evictions,
-            timeouts: this.stats.timeouts,
+            hits: this._stats.hits,
+            misses: this._stats.misses,
+            evictions: this._stats.evictions,
+            timeouts: this._stats.timeouts,
             hitRate: hitRate + '%',
             size: this.cache.size,
             maxSize: this.maxSize,
@@ -128,7 +142,7 @@ class AuthzCache {
      * Reset statistics (for testing/monitoring)
      */
     resetStats() {
-        this.stats = { hits: 0, misses: 0, evictions: 0, timeouts: 0 };
+        this._stats = { hits: 0, misses: 0, evictions: 0, timeouts: 0 };
     }
 }
 

package/lib/core/authz.js

@@ -4,13 +4,29 @@ const { validateRules } = require("../rules/validator")
 const { normalizeUser } = require("../utils/normalizeUser")
 const { evaluateAST } = require("../engine/conditionExecutor")
 const createMiddleware = require("./middleware")
+const AuthzCache = require("../cache")
 
 class Authz {
 
-    constructor() {
+    /**
+     * @param {object} [options]
+     * @param {boolean} [options.cacheEnabled=true]
+     * @param {number} [options.cacheSize=1000]
+     * @param {number} [options.cacheTTL=3600] seconds
+     */
+    constructor(options = {}) {
         this.permissions = {}
         this.conditions = {}
-        this.cache = new Map()
+        this.rules = []
+        // Previously this was a plain Map keyed by JSON.stringify(...) that
+        // was checked in can() but never written to (no .set() call), so
+        // caching silently never happened. lib/cache.js already had a full
+        // LRU+TTL cache implementation sitting unused — wiring it in here.
+        this.cache = new AuthzCache({
+            enabled: options.cacheEnabled !== false,
+            maxSize: options.cacheSize || 1000,
+            ttl: options.cacheTTL || 3600
+        })
     }
 
     load(filePath) {
@@ -20,19 +36,55 @@ class Authz {
 
         const compiled = compileRules(rules)
 
+        this.rules = rules
         this.permissions = compiled.permissions
         this.conditions = compiled.conditions
+
+        // Stale decisions from a previous policy must not survive a reload.
+        this.cache.clear()
+    }
+
+    getRules() {
+        return this.rules
+    }
+
+    cacheStats() {
+        return this.cache.stats()
+    }
+
+    /**
+     * Manually invalidate cached decisions. Caching keys on id/owner_id (or a
+     * snapshot of the data if neither exists) — so if a resource's OTHER
+     * fields change (e.g. a document gets locked) while its id stays the
+     * same, a cached decision from before that change can still be served
+     * until the TTL expires. Call this right after any write that could
+     * affect a condition's outcome, or set `cacheTTL` low / `cacheEnabled:
+     * false` for policies with conditions on fast-changing fields.
+     */
+    clearCache() {
+        return this.cache.clear()
     }
 
     can(user, action, resourceType, data = {}) {
 
         const roles = normalizeUser(user)
-        const cacheKey = JSON.stringify({ user, action, resourceType, data })
-
-        if (this.cache.has(cacheKey)) {
-            return this.cache.get(cacheKey)
+        // Cache key needs something that uniquely identifies this resource.
+        // id/owner_id is cheap and covers the common case. When neither is
+        // present, fall back to a stringified snapshot of the data — without
+        // this, two different payloads with no id (e.g. {age:25} vs {age:10})
+        // would collide onto the same cache key and one call's result would
+        // wrongly get served to the other.
+        const objectId = data && (data.id ?? data.owner_id ?? JSON.stringify(data))
+
+        const cached = this.cache.get(user, action, resourceType, objectId)
+
+        if (cached !== null) {
+            return cached
         }
 
+        let result = false
+
+        outer:
         for (const role of roles) {
 
             const rolePerm = this.permissions[role]
@@ -44,14 +96,16 @@ class Authz {
                 if (resourcePerm) {
 
                     if (resourcePerm.has("*") || resourcePerm.has(action)) {
-                        return true
+                        result = true
+                        break outer
                     }
                 }
 
                 if (rolePerm["*"]) {
 
                     if (rolePerm["*"].has("*") || rolePerm["*"].has(action)) {
-                        return true
+                        result = true
+                        break outer
                     }
                 }
             }
@@ -76,12 +130,14 @@ class Authz {
                 }
 
                 if (evaluateAST(cond, context)) {
-                    return true
+                    result = true
+                    break outer
                 }
             }
         }
 
-        return false
+        this.cache.set(user, action, resourceType, objectId, result)
+        return result
     }
 
     explain(user, action, resourceType, data = {}) {
@@ -174,9 +230,9 @@ class Authz {
     }
 }
 
-Authz.prototype.middleware = function (action, resourceType) {
+Authz.prototype.middleware = function (action, resourceType, getResource) {
     const middleware = createMiddleware(this)
-    return middleware(action, resourceType)
+    return middleware(action, resourceType, getResource)
 }
 
 module.exports = Authz

package/lib/core/middleware.js

@@ -1,22 +1,44 @@
+/**
+ * @param {Authz} authz
+ */
 module.exports = function (authz) {
-    return function (action, resourceType) {
-        return (req, res, next) => {
+    /**
+     * @param {string} action
+     * @param {string} resourceType
+     * @param {(req: import('express').Request) => any | Promise<any>} [getResource]
+     *   Optional loader that returns the REAL resource (e.g. fetched from DB)
+     *   to authorize against. If omitted, falls back to `req.body` for
+     *   backwards compatibility — but be aware `req.body` is client-controlled
+     *   and MUST NOT be trusted for ownership/condition checks (a caller can
+     *   put whatever `owner_id` they want in the body). Always pass
+     *   `getResource` when your policy uses conditions like
+     *   `resource.owner_id == user.id`.
+     */
+    return function (action, resourceType, getResource) {
+        return async (req, res, next) => {
             const user = req.user
-            const resource = req.body || {}
 
             if (!user) {
                 return res.status(401).json({ error: "Unauthorized" })
             }
 
-            const allowed = authz.can(user, action, resourceType, resource)
+            try {
+                const resource = typeof getResource === "function"
+                    ? await getResource(req)
+                    : (req.body || {})
 
-            if (allowed) {
-                return next()
-            }
+                const allowed = authz.can(user, action, resourceType, resource)
+
+                if (allowed) {
+                    return next()
+                }
 
-            return res.status(403).json({
-                error: "Forbidden"
-            })
+                return res.status(403).json({
+                    error: "Forbidden"
+                })
+            } catch (err) {
+                return next(err)
+            }
         }
     }
 }

package/lib/engine/conditionCompiler.js

@@ -1,16 +1,106 @@
+/**
+ * Split `str` on `delimiter`, but ignore any delimiter occurrence that falls
+ * inside a quoted string literal. Without this, a condition like
+ * `doc.title == "Terms AND Conditions"` would get incorrectly split in the
+ * middle of its own string literal, since the naive version just looked for
+ * the substring " AND " anywhere in the raw text.
+ */
+function splitOutsideQuotes(str, delimiter) {
+
+    const parts = []
+    let current = ""
+    let inQuote = null
+
+    for (let i = 0; i < str.length; i++) {
+
+        const ch = str[i]
+
+        if (inQuote) {
+            current += ch
+            if (ch === inQuote) inQuote = null
+            continue
+        }
+
+        if (ch === '"' || ch === "'") {
+            inQuote = ch
+            current += ch
+            continue
+        }
+
+        if (str.startsWith(delimiter, i)) {
+            parts.push(current)
+            current = ""
+            i += delimiter.length - 1
+            continue
+        }
+
+        current += ch
+    }
+
+    parts.push(current)
+    return parts
+}
+
+/**
+ * Find the first comparison operator that appears outside any quoted
+ * literal. Longer operators are checked first at each position so ">=" is
+ * matched instead of being mistaken for ">" followed by "=".
+ */
+function findTopLevelOperator(expr) {
+
+    const operators = ["==", "!=", ">=", "<=", ">", "<"]
+    let inQuote = null
+
+    for (let i = 0; i < expr.length; i++) {
+
+        const ch = expr[i]
+
+        if (inQuote) {
+            if (ch === inQuote) inQuote = null
+            continue
+        }
+
+        if (ch === '"' || ch === "'") {
+            inQuote = ch
+            continue
+        }
+
+        for (const op of operators) {
+            if (expr.startsWith(op, i)) {
+                return { operator: op, index: i }
+            }
+        }
+    }
+
+    return null
+}
+
 function detectLogical(condition) {
 
-    if (condition.includes(" AND ")) {
+    const andParts = splitOutsideQuotes(condition, " AND ")
+    const orParts = splitOutsideQuotes(condition, " OR ")
+
+    const hasAnd = andParts.length > 1
+    const hasOr = orParts.length > 1
+
+    if (hasAnd && hasOr) {
+        throw new Error(
+            `Mixing AND and OR in a single condition is not supported: "${condition}". ` +
+            `Split this into separate rules instead.`
+        )
+    }
+
+    if (hasAnd) {
         return {
             operator: "AND",
-            parts: condition.split(" AND ")
+            parts: andParts
         }
     }
 
-    if (condition.includes(" OR ")) {
+    if (hasOr) {
         return {
             operator: "OR",
-            parts: condition.split(" OR ")
+            parts: orParts
         }
     }
 
@@ -19,24 +109,29 @@ function detectLogical(condition) {
 
 function parseComparison(expr) {
 
-    const operators = ["==", "!=", ">=", "<=", ">", "<"]
-
-    for (const op of operators) {
+    // Previously this scanned for each operator with .includes()/.split(),
+    // which splits on EVERY occurrence in the string — including one that
+    // happens to sit inside a quoted literal (e.g. `a == "x==y"`) — and then
+    // silently discarded everything past the first two resulting pieces.
+    const found = findTopLevelOperator(expr)
 
-        if (expr.includes(op)) {
+    if (!found) {
+        throw new Error(`Invalid condition: ${expr}`)
+    }
 
-            const [left, right] = expr.split(op).map(s => s.trim())
+    const left = expr.slice(0, found.index).trim()
+    const right = expr.slice(found.index + found.operator.length).trim()
 
-            return {
-                type: "comparison",
-                operator: op,
-                left,
-                right
-            }
-        }
+    if (!left || !right) {
+        throw new Error(`Invalid condition: "${expr}" is missing an operand.`)
     }
 
-    throw new Error(`Invalid condition: ${expr}`)
+    return {
+        type: "comparison",
+        operator: found.operator,
+        left,
+        right
+    }
 }
 
 function compileCondition(condition) {
@@ -47,11 +142,17 @@ function compileCondition(condition) {
         return parseComparison(condition)
     }
 
-    return {
+    // Previously only logical.parts[0] and logical.parts[1] were used, so any
+    // clause past the second one in a chain like "a AND b AND c" was silently
+    // dropped (c never gets checked). Fold every clause into a left-leaning
+    // AST so chains of any length are honored.
+    const nodes = logical.parts.map(part => parseComparison(part.trim()))
+
+    return nodes.reduce((left, right) => ({
         type: logical.operator,
-        left: parseComparison(logical.parts[0]),
-        right: parseComparison(logical.parts[1])
-    }
+        left,
+        right
+    }))
 }
 
 module.exports = { compileCondition }

package/lib/engine/conditionExecutor.js

@@ -13,17 +13,41 @@ function getValue(path, context) {
     return value
 }
 
+/**
+ * Determine whether the right-hand side of a condition is a literal value
+ * (string, number, boolean, null) rather than a field path to look up in
+ * context. Previously only quoted strings were treated as literals, so
+ * `count > 5` or `active == true` silently resolved `5`/`true` as a field
+ * path (e.g. context["5"]), which is always undefined — the condition could
+ * never match.
+ */
+function parseLiteral(raw) {
+
+    if ((raw.startsWith('"') && raw.endsWith('"')) ||
+        (raw.startsWith("'") && raw.endsWith("'"))) {
+        return { isLiteral: true, value: raw.slice(1, -1) }
+    }
+
+    if (raw === "true") return { isLiteral: true, value: true }
+    if (raw === "false") return { isLiteral: true, value: false }
+    if (raw === "null") return { isLiteral: true, value: null }
+
+    if (/^-?\d+(\.\d+)?$/.test(raw)) {
+        return { isLiteral: true, value: Number(raw) }
+    }
+
+    return { isLiteral: false, value: undefined }
+}
+
 function evaluateComparison(node, context) {
 
     const leftVal = getValue(node.left, context)
 
-    let rightVal
+    const literal = parseLiteral(node.right)
 
-    if (node.right.startsWith('"') || node.right.startsWith("'")) {
-        rightVal = node.right.slice(1, -1)
-    } else {
-        rightVal = getValue(node.right, context)
-    }
+    const rightVal = literal.isLiteral
+        ? literal.value
+        : getValue(node.right, context)
 
     switch (node.operator) {
 

package/lib/rules/parser.js

@@ -1,38 +1,88 @@
 const fs = require("fs")
 
+const KNOWN_KEYS = ["role", "action", "resource", "condition"]
+
 function parseRules(filePath) {
 
     const content = fs.readFileSync(filePath, "utf8")
-
-    const lines = content.split("\n").map(l => l.trim())
+    const rawLines = content.split("\n")
 
     const rules = []
     let current = null
+    let ruleStartLine = null
+
+    rawLines.forEach((rawLine, idx) => {
 
-    for (const line of lines) {
+        const lineNumber = idx + 1
+        const line = rawLine.trim()
 
-        if (!line || line.startsWith("#")) continue
+        if (!line || line.startsWith("#")) return
 
         if (line === "rule") {
+
+            // Previously this silently overwrote `current`, discarding an
+            // already-open rule block that was missing its "end".
+            if (current) {
+                throw new Error(
+                    `Policy parse error at line ${lineNumber}: found "rule" but the ` +
+                    `rule opened at line ${ruleStartLine} is still unclosed (missing "end").`
+                )
+            }
+
             current = {}
+            ruleStartLine = lineNumber
+            return
         }
 
-        else if (line === "end") {
+        if (line === "end") {
+
+            // Previously this pushed `current` (= null for a stray "end")
+            // straight into `rules`, which crashed later in validateRules
+            // with an unhelpful "Cannot read properties of null".
+            if (!current) {
+                throw new Error(
+                    `Policy parse error at line ${lineNumber}: found "end" with no matching "rule".`
+                )
+            }
+
             rules.push(current)
             current = null
+            ruleStartLine = null
+            return
         }
 
-        else if (current) {
+        if (!current) {
+            throw new Error(
+                `Policy parse error at line ${lineNumber}: "${line}" appears outside ` +
+                `of a rule/end block.`
+            )
+        }
 
-            const [key, ...rest] = line.split(" ")
-            const value = rest.join(" ")
+        const [key, ...rest] = line.split(" ")
+        const value = rest.join(" ")
 
-            if (key === "role") current.role = value
-            if (key === "action") current.action = value
-            if (key === "resource") current.resource = value
-            if (key === "condition") current.condition = value
+        // Previously an unrecognized key (e.g. "roel" typo'd for "role")
+        // was silently dropped, leaving the rule incomplete with no warning.
+        if (!KNOWN_KEYS.includes(key)) {
+            throw new Error(
+                `Policy parse error at line ${lineNumber}: unknown key "${key}" ` +
+                `(expected one of: ${KNOWN_KEYS.join(", ")}).`
+            )
+        }
 
+        if (!value) {
+            throw new Error(
+                `Policy parse error at line ${lineNumber}: "${key}" has no value.`
+            )
         }
+
+        current[key] = value
+    })
+
+    if (current) {
+        throw new Error(
+            `Policy parse error: rule opened at line ${ruleStartLine} was never closed with "end".`
+        )
     }
 
     return rules

package/lib/rules/validator.js

@@ -1,3 +1,5 @@
+const { compileCondition } = require("../engine/conditionCompiler")
+
 function validateRules(rules) {
 
     const errors = []
@@ -20,17 +22,21 @@ function validateRules(rules) {
 
         if (rule.condition) {
 
-            const validOperators = [
-                "==", "!=", ">", "<", ">=", "<="
-            ]
-
-            const hasOperator = validOperators.some(op =>
-                rule.condition.includes(op)
-            )
-
-            if (!hasOperator) {
+            // Previously this only checked whether an operator substring
+            // (e.g. "==") appeared ANYWHERE in the condition text — it never
+            // actually verified the condition parses. A condition like
+            // "doc.status ==" (missing right-hand side) or one with mismatched
+            // AND/OR usage would pass this check and then either crash later
+            // deep inside the compiler with no rule number attached, or (worse)
+            // silently compile into a broken/always-false comparison.
+            //
+            // Actually attempting to compile it here catches real structural
+            // problems immediately, at the rule they belong to.
+            try {
+                compileCondition(rule.condition)
+            } catch (err) {
                 errors.push(
-                    `Rule ${ruleNumber}: invalid condition "${rule.condition}"`
+                    `Rule ${ruleNumber}: invalid condition "${rule.condition}" — ${err.message}`
                 )
             }
         }

package/package.json

@@ -1,50 +1,52 @@
-{
-  "name": "simple-authz",
-  "version": "1.1.0",
-  "description": "Lightweight policy-based authorization engine for Node.js using TOON policy language",
-  "main": "lib/index.js",
-  "scripts": {
-    "test": "jest",
-    "dev": "node lib/core/authz.js"
-  },
-  "bin": {
-    "simple-authz": "bin/simple-authz"
-  },
-  "devDependencies": {
-    "chalk": "^5.0.0",
-    "commander": "^11.0.0",
-    "jest": "^30.3.0"
-  },
-  "keywords": [
-    "authorization",
-    "access-control",
-    "auth",
-    "policy-engine",
-    "rbac",
-    "abac",
-    "permissions",
-    "nodejs-auth",
-    "authorization-library",
-    "security",
-    "policy-based-access",
-    "authz",
-    "role-based-access-control",
-    "authorization-engine"
-  ],
-  "types": "types/index.d.ts",
-  "files": [
-    "lib/",
-    "types/",
-    "package.json"
-  ],
-  "author": "Dhruvil",
-  "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/dhruvil05/simple-authz"
-  },
-  "bugs": {
-    "url": "https://github.com/dhruvil05/simple-authz/issues"
-  },
-  "homepage": "https://github.com/dhruvil05/simple-authz#readme"
-}
+{
+  "name": "simple-authz",
+  "version": "1.2.0",
+  "description": "Lightweight policy-based authorization engine for Node.js using TOON policy language",
+  "main": "lib/index.js",
+  "scripts": {
+    "test": "jest",
+    "dev": "node lib/core/authz.js"
+  },
+  "bin": {
+    "simple-authz": "bin/simple-authz/index.js"
+  },
+  "dependencies": {
+    "chalk": "^4.1.2",
+    "commander": "^11.0.0"
+  },
+  "devDependencies": {
+    "jest": "^30.3.0"
+  },
+  "keywords": [
+    "authorization",
+    "access-control",
+    "auth",
+    "policy-engine",
+    "rbac",
+    "abac",
+    "permissions",
+    "nodejs-auth",
+    "authorization-library",
+    "security",
+    "policy-based-access",
+    "authz",
+    "role-based-access-control",
+    "authorization-engine"
+  ],
+  "types": "types/index.d.ts",
+  "files": [
+    "lib/",
+    "types/",
+    "package.json"
+  ],
+  "author": "Dhruvil",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/dhruvil05/simple-authz"
+  },
+  "bugs": {
+    "url": "https://github.com/dhruvil05/simple-authz/issues"
+  },
+  "homepage": "https://github.com/dhruvil05/simple-authz#readme"
+}