initial commit: @arbiter/core authorization engine with js-rigor hardening
Zanzibar-style authorization graph engine (direct/chain/TTU/defeasible/ binary modes, condensed snapshots, value relations) with 39 rigor test campaigns. Includes fixes for snapshot binary writer/reader format mismatch (snapshot-of-snapshot corruption), possibility write-boundary validation, empty-graph snapshot serialization, relation lookup cache direction collision, config-redefinition cache invalidation, binary threshold semantics, defeasible compiled routing, and comparator reason whitelisting.
This commit is contained in:
John Dvorak
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,165 @@
|
||||
/**
|
||||
* Optimized IP Address Utilities
|
||||
*
|
||||
* High-performance versions for hot paths
|
||||
*/
|
||||
|
||||
// CIDR cache for repeated lookups
|
||||
const cidrCache = new Map();
|
||||
const CIDR_CACHE_SIZE = 1000;
|
||||
|
||||
/**
|
||||
* Fast IPv4 check - less strict but much faster
|
||||
* Only validates format, not strict numeric ranges
|
||||
*/
|
||||
export function isIPv4Fast(ip) {
|
||||
if (typeof ip !== 'string') return false;
|
||||
|
||||
// Quick length check (min: 7 for "0.0.0.0", max: 15 for "255.255.255.255")
|
||||
if (ip.length < 7 || ip.length > 15) return false;
|
||||
|
||||
let dots = 0;
|
||||
for (let i = 0; i < ip.length; i++) {
|
||||
const c = ip.charCodeAt(i);
|
||||
if (c === 46) { // '.'
|
||||
dots++;
|
||||
} else if (c < 48 || c > 57) { // not 0-9
|
||||
return false;
|
||||
}
|
||||
}
|
||||
return dots === 3;
|
||||
}
|
||||
|
||||
/**
|
||||
* Ultra-fast IP to integer conversion
|
||||
* Direct character parsing, no string splitting
|
||||
*/
|
||||
export function ipToIntFast(ip) {
|
||||
let result = 0;
|
||||
let octet = 0;
|
||||
let shift = 24;
|
||||
|
||||
for (let i = 0; i < ip.length; i++) {
|
||||
const c = ip.charCodeAt(i);
|
||||
if (c === 46) { // '.'
|
||||
result |= (octet << shift);
|
||||
octet = 0;
|
||||
shift -= 8;
|
||||
} else {
|
||||
octet = octet * 10 + (c - 48);
|
||||
}
|
||||
}
|
||||
|
||||
return (result | octet) >>> 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Fast CIDR parsing with caching
|
||||
*/
|
||||
export function parseCidrCached(cidr) {
|
||||
// Check cache first
|
||||
let cached = cidrCache.get(cidr);
|
||||
if (cached) return cached;
|
||||
|
||||
// Parse and cache
|
||||
const slashIdx = cidr.indexOf('/');
|
||||
if (slashIdx === -1) return null;
|
||||
|
||||
const ip = cidr.slice(0, slashIdx);
|
||||
const prefix = parseInt(cidr.slice(slashIdx + 1), 10);
|
||||
const mask = -1 << (32 - prefix);
|
||||
|
||||
cached = {
|
||||
network: ipToIntFast(ip),
|
||||
mask,
|
||||
prefix
|
||||
};
|
||||
|
||||
// Simple LRU - clear if too big
|
||||
if (cidrCache.size >= CIDR_CACHE_SIZE) {
|
||||
cidrCache.clear();
|
||||
}
|
||||
cidrCache.set(cidr, cached);
|
||||
|
||||
return cached;
|
||||
}
|
||||
|
||||
/**
|
||||
* Ultra-fast IP in CIDR check
|
||||
* Uses caching and optimized parsing
|
||||
*/
|
||||
export function isIpInCidrFast(ip, cidr) {
|
||||
const cached = parseCidrCached(cidr);
|
||||
if (!cached) return false;
|
||||
|
||||
const ipInt = ipToIntFast(ip);
|
||||
return (ipInt & cached.mask) === (cached.network & cached.mask);
|
||||
}
|
||||
|
||||
/**
|
||||
* Fast private IP check using bit manipulation
|
||||
*/
|
||||
export function isPrivateIpFast(ip) {
|
||||
const ipInt = ipToIntFast(ip);
|
||||
|
||||
// 10.0.0.0/8: 0x0A000000 to 0x0AFFFFFF
|
||||
if ((ipInt >>> 24) === 10) return true;
|
||||
|
||||
// 172.16.0.0/12: 0xAC100000 to 0xAC1FFFFF
|
||||
const high16 = ipInt >>> 16;
|
||||
if (high16 >= 0xAC10 && high16 <= 0xAC1F) return true;
|
||||
|
||||
// 192.168.0.0/16: 0xC0A80000 to 0xC0A8FFFF
|
||||
if (high16 === 0xC0A8) return true;
|
||||
|
||||
// 127.0.0.0/8: 0x7F000000 to 0x7FFFFFFF
|
||||
if ((ipInt >>> 24) === 127) return true;
|
||||
|
||||
// 169.254.0.0/16: 0xA9FE0000 to 0xA9FEFFFF
|
||||
if (high16 === 0xA9FE) return true;
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Optimized built-in function evaluator
|
||||
* Direct dispatch without object lookups
|
||||
*/
|
||||
export function evaluateBuiltInFast(name, args) {
|
||||
switch (name) {
|
||||
case 'ip_in_cidr':
|
||||
return isIpInCidrFast(args[0], args[1]);
|
||||
case 'ip_is_private':
|
||||
return isPrivateIpFast(args[0]);
|
||||
case 'ip_is_loopback':
|
||||
return (ipToIntFast(args[0]) >>> 24) === 127;
|
||||
case 'ip_version':
|
||||
return isIPv4Fast(args[0]) ? 4 : (args[0].includes(':') ? 6 : null);
|
||||
case 'ip_equals':
|
||||
return args[0] === args[1];
|
||||
case 'contains':
|
||||
return String(args[0]).includes(String(args[1]));
|
||||
case 'starts_with':
|
||||
return String(args[0]).startsWith(String(args[1]));
|
||||
case 'ends_with':
|
||||
return String(args[0]).endsWith(String(args[1]));
|
||||
case 'equals':
|
||||
return args[0] === args[1];
|
||||
case 'greater_than':
|
||||
return args[0] > args[1];
|
||||
case 'less_than':
|
||||
return args[0] < args[1];
|
||||
case 'in_range':
|
||||
return args[0] >= args[1] && args[0] <= args[2];
|
||||
case 'hour_of_day':
|
||||
return new Date(args[0]).getHours();
|
||||
case 'day_of_week':
|
||||
return new Date(args[0]).getDay();
|
||||
default:
|
||||
throw new Error(`Unknown: ${name}`);
|
||||
}
|
||||
}
|
||||
|
||||
// Re-export original functions for compatibility
|
||||
export { isIPv4, isIPv6, isLoopbackIp, getIpVersion, normalizeIp } from './ip-utils.js';
|
||||
export { isIpInCidr, isPrivateIp } from './ip-utils.js';
|
||||
@@ -0,0 +1,123 @@
|
||||
/**
|
||||
* IP Address Utilities
|
||||
*/
|
||||
|
||||
import { createRequire } from 'node:module';
|
||||
|
||||
/**
|
||||
* Check if string is IPv4
|
||||
*/
|
||||
export function isIPv4(ip) {
|
||||
if (typeof ip !== 'string') return false;
|
||||
const parts = ip.split('.');
|
||||
if (parts.length !== 4) return false;
|
||||
|
||||
return parts.every(part => {
|
||||
const num = parseInt(part, 10);
|
||||
return !isNaN(num) && num >= 0 && num <= 255 && part === String(num);
|
||||
});
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if string is IPv6
|
||||
*/
|
||||
export function isIPv6(ip) {
|
||||
if (typeof ip !== 'string') return false;
|
||||
// Simple check - contains colons and valid hex
|
||||
return ip.includes(':') && /^[0-9a-fA-F:]+$/.test(ip);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if IP is in private range (RFC 1918)
|
||||
*/
|
||||
export function isPrivateIp(ip) {
|
||||
if (!isIPv4(ip)) return false;
|
||||
|
||||
const parts = ip.split('.').map(Number);
|
||||
const [a, b, c, d] = parts;
|
||||
|
||||
// 10.0.0.0/8
|
||||
if (a === 10) return true;
|
||||
|
||||
// 172.16.0.0/12
|
||||
if (a === 172 && b >= 16 && b <= 31) return true;
|
||||
|
||||
// 192.168.0.0/16
|
||||
if (a === 192 && b === 168) return true;
|
||||
|
||||
// 127.0.0.0/8 (loopback)
|
||||
if (a === 127) return true;
|
||||
|
||||
// 169.254.0.0/16 (link-local)
|
||||
if (a === 169 && b === 254) return true;
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if IP is loopback
|
||||
*/
|
||||
export function isLoopbackIp(ip) {
|
||||
if (!isIPv4(ip)) return false;
|
||||
return ip.startsWith('127.');
|
||||
}
|
||||
|
||||
/**
|
||||
* Convert IP to integer for range comparison
|
||||
*/
|
||||
export function ipToInt(ip) {
|
||||
return ip.split('.').reduce((acc, octet) => (acc << 8) + parseInt(octet, 10), 0) >>> 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* Parse CIDR notation
|
||||
*/
|
||||
export function parseCidr(cidr) {
|
||||
const [ip, prefix] = cidr.split('/');
|
||||
const mask = -1 << (32 - parseInt(prefix, 10));
|
||||
return { ip: ipToInt(ip), mask };
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if IP is in CIDR range
|
||||
*/
|
||||
export function isIpInCidr(ip, cidr) {
|
||||
if (!isIPv4(ip)) return false;
|
||||
|
||||
try {
|
||||
const ipInt = ipToInt(ip);
|
||||
const { ip: networkInt, mask } = parseCidr(cidr);
|
||||
|
||||
return (ipInt & mask) === (networkInt & mask);
|
||||
} catch (err) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if two IPs are equal
|
||||
*/
|
||||
export function ipEquals(ip1, ip2) {
|
||||
return ip1 === ip2;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get IP version (4 or 6)
|
||||
*/
|
||||
export function getIpVersion(ip) {
|
||||
if (isIPv4(ip)) return 4;
|
||||
if (isIPv6(ip)) return 6;
|
||||
return null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Normalize IP (remove leading zeros, etc.)
|
||||
*/
|
||||
export function normalizeIp(ip) {
|
||||
if (!isIPv4(ip)) return ip;
|
||||
|
||||
return ip
|
||||
.split('.')
|
||||
.map(part => parseInt(part, 10).toString())
|
||||
.join('.');
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
import { uuidv7 } from 'uuidv7';
|
||||
|
||||
export function generateStateId() {
|
||||
return uuidv7();
|
||||
}
|
||||
|
||||
export function compareStateIds(id1, id2) {
|
||||
// UUIDv7 is time-ordered, so we can compare them directly
|
||||
return id1.localeCompare(id2);
|
||||
}
|
||||
|
||||
export function isForward(id1, id2) {
|
||||
return compareStateIds(id1, id2) < 0;
|
||||
}
|
||||
|
||||
export function isBackward(id1, id2) {
|
||||
return compareStateIds(id1, id2) > 0;
|
||||
}
|
||||
Reference in New Issue
Block a user