diff --git a/package-lock.json b/package-lock.json index 1197f7a..1e0fd7b 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,15 +1,15 @@ { "name": "@arbiter/evidence-dsl", - "version": "1.6.0", + "version": "1.12.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@arbiter/evidence-dsl", - "version": "1.6.0", + "version": "1.12.0", "license": "ISC", "dependencies": { - "@arbiter/core": "^1.0.4" + "@arbiter/core": "^1.0.7" }, "devDependencies": { "@rigor/core": "^3.1.0", @@ -17,9 +17,9 @@ } }, "node_modules/@arbiter/core": { - "version": "1.0.4", - "resolved": "https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/%40arbiter%2Fcore/-/1.0.4/core-1.0.4.tgz", - "integrity": "sha512-1zXy3mZACjwELptsV8QpYvZJmMU7BhUQ4FsKNfp3/oJDwjfMqAImcAF3mJ+HNZpQnLQXScmELTwow5VduvN27g==", + "version": "1.0.7", + "resolved": "https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/%40arbiter%2Fcore/-/1.0.7/core-1.0.7.tgz", + "integrity": "sha512-DgeU8HIJS5K3TnZoVyh6nphy7ZLQA5lzV/icZUvF77XOB5W5ObkGKOSH42LVPA/BEcKlBLrWFgoCB56badLBJg==", "license": "ISC", "dependencies": { "@tenere/pltc-core": "^0.6.3", diff --git a/package.json b/package.json index 6d30e2c..082cb08 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@arbiter/evidence-dsl", - "version": "1.11.0", + "version": "1.12.0", "description": "Evidence DSL v2 compiler: translates the natural Evidence DSL (ADR-000) into @arbiter/core relation configurations.", "license": "ISC", "type": "module", @@ -24,7 +24,7 @@ "generate:parser": "node scripts/generate-parser.js" }, "dependencies": { - "@arbiter/core": "^1.0.4" + "@arbiter/core": "^1.0.7" }, "devDependencies": { "@rigor/core": "^3.1.0", diff --git a/src/DSLCompiler.js b/src/DSLCompiler.js index 98a5b6f..e26463b 100644 --- a/src/DSLCompiler.js +++ b/src/DSLCompiler.js @@ -39,13 +39,15 @@ export class DSLCompiler { const programNode = { definitions: program.body.filter(s => s.type === 'Definition'), facts: program.body.filter(s => s.type === 'Fact'), + sources: program.body.filter(s => s.type === 'Source'), evidence: program.body.filter(s => s.type === 'Evidence'), measures: program.body.filter(s => s.type === 'Measure'), validate: () => ({ isValid: true, errors: [], warnings: [] }) }; - // Generate rules from AST - const generationResult = this.generator.generateRules(programNode); + // Generate rules from AST (scoped to the program name so recompiling a + // scope revokes its stale relations without touching other scopes). + const generationResult = this.generator.generateRules(programNode, programName); if (!generationResult.success) { return { diff --git a/src/generator/RuleGenerator.js b/src/generator/RuleGenerator.js index 21f311c..aa634f5 100644 --- a/src/generator/RuleGenerator.js +++ b/src/generator/RuleGenerator.js @@ -11,6 +11,14 @@ export class RuleGenerator { this.errors = []; this.dependencyIndex = new Map(); this.evidenceNames = new Set(); + // Relation names this generator has installed on the arbiter, tracked PER + // PROGRAM SCOPE (the compile() program name). Recompiling the same scope + // uninstalls relations that scope previously declared but no longer does — + // otherwise a revoked evidence/fact keeps its config and still grants + // (stale-permission leak). Relations from OTHER scopes (compileMultiple + // coexistence) are never touched. + this._installedByScope = new Map(); + this._currentScope = 'default'; // Default depth for bounded self-recursion when the DSL `limit N` is absent. this.maxRecursionDepth = options.maxRecursionDepth ?? 3; } @@ -20,10 +28,25 @@ export class RuleGenerator { * @param {ProgramNode} program - AST program to generate rules from * @returns {Object} Generation result with success status and errors */ - generateRules(program) { + generateRules(program, scopeName = 'default') { this.errors = []; + this._currentScope = scopeName; + this.program = program; this.generatedRules.clear(); this.dependencyIndex.clear(); + // Facts declared `BEHAVES AS transitive` are resolved as bounded transitive + // closure (multi_hop) everywhere they are referenced — both the fact's own + // config and any direct rule that references the fact. Without this the + // declaration parses but grants only direct edges (silent no-op). Value is + // the closure depth (the fact's `limit N`, or the recursion default). + this.transitiveFacts = new Map(); + for (const fact of program.facts || []) { + const behavior = fact && fact.behavior; + if (behavior && (behavior.behavior === 'transitive' || behavior === 'transitive')) { + const depth = (fact.limit && typeof fact.limit === 'object' ? fact.limit.value : fact.limit) ?? this.maxRecursionDepth; + this.transitiveFacts.set(fact.name, depth); + } + } try { // Generate rules for each evidence definition @@ -41,6 +64,14 @@ export class RuleGenerator { this.generateFactConfig(fact); }); + // Generate source relation configs (injectable, recency-gated proofs). + // Without a config a source referenced by an evidence would never + // resolve — the reference would lower to a config-less direct rule that + // grants nothing. + (program.sources || []).forEach(source => { + this.generateSourceConfig(source); + }); + // Resolve evidence composition: a rule that references another derived // evidence (WHEN can_read(user, doc) where can_read is an evidence) is // lowered in place to that evidence's own config — compile-time inlining @@ -109,9 +140,13 @@ export class RuleGenerator { const paramNames = params.map(p => p.name); const paramTypes = params.map(p => p.type); - this.generatedRules.set(name, { - type: 'direct', - relation: name, + // BEHAVES AS transitive: the fact resolves to bounded transitive closure. + // A multi_hop config walks the relation's edges up to maxDepth (the fact's + // `limit N`, or the recursion default), so a direct check on the fact — + // and any evidence that references it — follows multi-hop paths instead of + // only direct edges. + const transitiveDepth = this.transitiveFacts.get(name); + const base = { isFactRelation: true, requiresInjection: true, arity: paramTypes.length, @@ -123,6 +158,39 @@ export class RuleGenerator { typeof p === 'string' ? [p, true] : Array.isArray(p) ? p : [p, true] ) ) + }; + + this.generatedRules.set(name, transitiveDepth !== undefined + ? { + type: 'multi_hop', + relation: name, + maxDepth: transitiveDepth, + pathAggregation: 'max', + reverse: false, + fallbackToBasicPaths: true, + collectValues: false, + ...base + } + : { + type: 'direct', + relation: name, + ...base + }); + } + + generateSourceConfig(source) { + const name = source.name; + const params = source.params || []; + const withinMs = source.within ? this._durationToMs(source.within) : null; + this.generatedRules.set(name, { + type: 'direct', + relation: name, + isSourceRelation: true, + requiresInjection: true, + arity: params.length, + paramTypes: params.map(p => p.paramType), + paramNames: params.map(p => p.name), + ...(withinMs !== null ? { withinMs } : {}) }); } @@ -298,7 +366,7 @@ export class RuleGenerator { case 'PredicateCall': return this.buildPredicateRule(statement, evidence); case 'UnaryExpression': - return this.buildUnaryRule(statement); + return this.buildUnaryRule(statement, evidence); case 'BinaryExpression': // Top-level comparator — emit a relational_comparator rule. RF-24 closure. return this.buildRuleFromExpressionNode(statement, evidence); @@ -317,15 +385,19 @@ export class RuleGenerator { /** * Build rule for unary expression (NOT) * @param {Object} expression - Unary expression + * @param {Object} evidence - Evidence definition (threaded through so a + * unary inner predicate like NOT banned(user) keeps its _subjectAsObject + * rewrite; without it the unary fact would be checked on the evidence's + * OBJECT node instead of the subject, silently negating the wrong fact). * @returns {Object|null} Rule configuration or null */ - buildUnaryRule(expression) { + buildUnaryRule(expression, evidence) { if (expression.operator !== 'NOT') { this.errors.push(`Unsupported unary operator: ${expression.operator}`); return null; } - const innerRule = this.buildRuleFromExpression(expression.operand); + const innerRule = this.buildRuleFromExpression(expression.operand, evidence); if (!innerRule) { return null; } @@ -482,6 +554,12 @@ export class RuleGenerator { const predicate = directEvidence.predicate; const relation = predicate.name; + // A reference to a `BEHAVES AS transitive` fact resolves to closure. + const transitiveDepth = this.transitiveFacts.get(relation); + if (transitiveDepth !== undefined) { + return this._buildTransitiveRule(relation, transitiveDepth, predicate.arguments || [], evidence); + } + const rule = { type: 'direct', relation: relation, @@ -505,6 +583,12 @@ export class RuleGenerator { } } + // A literal value in the object position (balance(user, 5)) is a VALUE + // constraint, not a node key: the rule only grants when the matched edge + // carries exactly that value. Without this gate a value-carrying fact + // would match ANY edge regardless of its amount (silent over-grant). + this._applyExpectedValue(rule, args); + return rule; } @@ -947,7 +1031,7 @@ export class RuleGenerator { } else if (expression.type === 'PredicateCall') { return this.buildPredicateRule(expression, evidence); } else if (expression.type === 'UnaryExpression') { - return this.buildUnaryRule(expression); + return this.buildUnaryRule(expression, evidence); } else if (expression.type === 'BinaryExpression') { return this.buildRuleFromExpressionNode(expression, evidence); } @@ -962,6 +1046,12 @@ export class RuleGenerator { * @returns {Object|null} Rule configuration or null */ buildDirectRuleFromPredicate(predicate, evidence) { + // A reference to a `BEHAVES AS transitive` fact resolves to closure. + const transitiveDepth = this.transitiveFacts.get(predicate.name); + if (transitiveDepth !== undefined) { + return this._buildTransitiveRule(predicate.name, transitiveDepth, predicate.args || [], evidence); + } + const rule = { type: 'direct', relation: predicate.name, @@ -975,6 +1065,58 @@ export class RuleGenerator { rule._subjectAsObject = true; } + // Value constraint: a literal in the object position (balance(user, 5)). + this._applyExpectedValue(rule, predicate.args || []); + + return rule; + } + + /** + * Annotate a direct rule with `expectedValue` when its object-position + * argument is a literal. The engine only grants the rule if the matched + * edge's `value` field equals this literal — without the gate a + * value-carrying fact would match any edge of the same relation, silently + * over-granting (e.g. balance(user, 5) matching a value-3 edge). + */ + _applyExpectedValue(rule, args) { + if (rule && args && args.length >= 2) { + const objectArg = args[1]; + if (objectArg && objectArg.type === 'Literal' && objectArg.value !== undefined) { + rule.expectedValue = objectArg.value; + } + } + return rule; + } + + /** + * Build a bounded transitive-closure rule for a `BEHAVES AS transitive` + * fact reference. Applies the same subject/object rewrite flags as the + * direct-rule builders so a unary or object-var reference still targets the + * correct nodes. + */ + _buildTransitiveRule(relation, maxDepth, args, evidence) { + const rule = { + type: 'multi_hop', + relation: relation, + maxDepth: maxDepth, + pathAggregation: 'max', + reverse: false, + fallbackToBasicPaths: true, + collectValues: false + }; + + const evidenceParams = (evidence && evidence.params) || []; + const objectVar = evidenceParams[1] && evidenceParams[1].name; + const argName = a => a && (a.name !== undefined ? a.name : a.value); + if (objectVar !== undefined) { + const hasObjectArg = args.some(a => a && a.type === 'Variable' && a.name === objectVar); + if (args.length === 1 && argName(args[0]) === objectVar) { + rule._subjectIsObject = true; + } else if (!hasObjectArg) { + rule._subjectAsObject = true; + } + } + return rule; } @@ -1391,6 +1533,13 @@ export class RuleGenerator { return this.buildChallengeRule(expression, null); } + // A reference to a `BEHAVES AS transitive` fact resolves to bounded + // transitive closure, not a direct edge lookup. + const transitiveDepth = this.transitiveFacts.get(predicateName); + if (transitiveDepth !== undefined) { + return this._buildTransitiveRule(predicateName, transitiveDepth, expression.args || [], evidence); + } + const rule = { type: 'direct', relation: predicateName, @@ -1418,6 +1567,11 @@ export class RuleGenerator { } } + // Value constraint: a literal in the object position (balance(user, 5)) + // is a VALUE gate, not a node key — the rule only grants when the matched + // edge carries exactly that value. + this._applyExpectedValue(rule, expression.args || []); + return rule; } @@ -1531,6 +1685,19 @@ export class RuleGenerator { return; } + // Recompile hygiene (per program scope): relations installed by a previous + // compile of THIS scope but absent from the current program are stale — + // remove their configs from every cache and index so a revoked relation + // stops granting immediately. Relations belonging to other scopes + // (compileMultiple coexistence) are left intact. + const scope = this._currentScope || 'default'; + const previously = this._installedByScope.get(scope) || new Set(); + for (const name of previously) { + if (!this.generatedRules.has(name)) { + this._uninstallRelation(name); + } + } + this.generatedRules.forEach((config, relation) => { try { this.arbiter.setRelationConfig(relation, config); @@ -1542,6 +1709,33 @@ export class RuleGenerator { if (typeof this.arbiter.registerDependencyIndex === 'function') { this.arbiter.registerDependencyIndex(this.dependencyIndex); } + + this._installedByScope.set(scope, new Set(this.generatedRules.keys())); + } + + /** + * Remove a relation's config and cached state from the arbiter. Mirrors the + * invalidation that setRelationConfig performs, applied to deletion. + */ + _uninstallRelation(name) { + const arb = this.arbiter; + if (!arb) return; + if (arb.relationConfigs && typeof arb.relationConfigs.delete === 'function') { + arb.relationConfigs.delete(name); + } + const analysis = arb.graphManager && arb.graphManager.analysis; + if (analysis && analysis.relationConfigs && typeof analysis.relationConfigs.delete === 'function') { + analysis.relationConfigs.delete(name); + } + if (typeof arb._invalidateDirectCheckCache === 'function') { + arb._invalidateDirectCheckCache(null, name, null); + } + if (typeof arb.invalidateRuleResultCacheByRelation === 'function') { + arb.invalidateRuleResultCacheByRelation(name); + } + if (arb.authChecker && typeof arb.authChecker.invalidateRuleCaches === 'function') { + arb.authChecker.invalidateRuleCaches(name); + } } /** diff --git a/src/runtime/DSLRuntime.js b/src/runtime/DSLRuntime.js index 9dfe38f..ec2b9f0 100644 --- a/src/runtime/DSLRuntime.js +++ b/src/runtime/DSLRuntime.js @@ -110,6 +110,9 @@ export class DSLRuntime { const facts = [...this.relations.entries()] .filter(([, r]) => r.kind === 'fact') .map(([name, r]) => ({ name, params: r.params, injectable: r.injectable })); + const sources = [...this.relations.entries()] + .filter(([, r]) => r.kind === 'source') + .map(([name, r]) => ({ name, params: r.params, injectable: true, withinMs: r.withinMs })); const evidence = [...this.relations.entries()] .filter(([, r]) => r.kind === 'evidence') .map(([name, r]) => ({ @@ -117,7 +120,7 @@ export class DSLRuntime { params: r.params, dependsOn: [...(this.dependsOn.get(name) || [])] })); - return { types, facts, evidence, providers: this.registeredFacts() }; + return { types, facts, sources, evidence, providers: this.registeredFacts() }; } /** All relation names declared by the program (facts + evidence). */ @@ -148,6 +151,18 @@ export class DSLRuntime { }); } + // Sources are injectable, recency-gated proofs: registered as retrievable + // relations so a provider can supply them and `within X` gates freshness. + for (const src of this.program.sources || []) { + this.relations.set(src.name, { + kind: 'source', + params: (src.params || []).map(p => ({ name: p.name, type: p.paramType, isArray: !!p.isArray })), + injectable: true, + ttlMs: 0, + withinMs: src.within ? this._durationToMs(src.within) : null + }); + } + for (const ev of this.program.evidence || []) { this.relations.set(ev.name, { kind: 'evidence', @@ -309,6 +324,17 @@ export class DSLRuntime { return null; } + /** Convert a Duration AST ({ value, unit }) to milliseconds. */ + _durationToMs(duration) { + if (!duration || duration.value === undefined) return null; + const raw = typeof duration.value === 'string' ? duration.value : String(duration.value); + const unit = duration.unit || raw.slice(-1); + const numeric = parseFloat(raw); + if (!Number.isFinite(numeric)) return null; + const mult = { s: 1000, m: 60_000, h: 3600_000, d: 86_400_000, w: 604_800_000 }[unit]; + return mult ? numeric * mult : null; + } + /** * Normalize a provider result (boolean / number / { possibility, value } / * array of edge objects) into an array of partial-graph edge objects. The @@ -323,6 +349,8 @@ export class DSLRuntime { const edges = Array.isArray(result) ? result : [result]; const secondParamType = factMeta.params[1] && factMeta.params[1].type; const isValueFact = factMeta.params.length >= 2 && this._isValueType(secondParamType); + // Sources carry a timestamp in `value` for their recency (`within X`) gate. + const isSource = factMeta.kind === 'source'; const defaultDst = isValueFact ? user : (factMeta.params.length >= 2 ? object : user); const label = `provider for '${fact}'`; const out = []; @@ -340,10 +368,14 @@ export class DSLRuntime { const possibility = edge.possibility ?? 1; this._checkPossibility(possibility, label); if (edge.value !== undefined) { - if (!isValueFact) { + if (!isValueFact && !isSource) { throw new Error(`DSLRuntime: ${label} returned a value for a non-value fact '${fact}'`); } - this._checkScalarValue(secondParamType, edge.value, `${label}.value`); + if (isValueFact) { + this._checkScalarValue(secondParamType, edge.value, `${label}.value`); + } else if (isSource && (typeof edge.value !== 'number' || Number.isNaN(edge.value))) { + throw new Error(`DSLRuntime: ${label} (a source) must return a numeric timestamp in value`); + } } else if (isValueFact) { throw new Error(`DSLRuntime: ${label} must supply a 'value' of type ${secondParamType}`); } @@ -549,7 +581,7 @@ export class DSLRuntime { /** * The partial-graph requirements of an evidence relation: the declared - * injectable facts it depends on. + * injectable facts and sources it depends on. */ requiredFacts(relation) { const deps = this.dependsOn.get(relation); @@ -558,6 +590,7 @@ export class DSLRuntime { for (const dep of deps) { const meta = this.relations.get(dep); if (meta && meta.kind === 'fact' && meta.injectable) required.push(dep); + if (meta && meta.kind === 'source') required.push(dep); } return required; } @@ -596,6 +629,11 @@ export class DSLRuntime { } else if (meta.params.length === 2) { this._checkNodeType(user, meta.params[0].type, 'subject'); this._checkNodeType(object, meta.params[1].type, 'object'); + // A value-typed object parameter (can_withdraw(user, amount: number)) + // carries the expected EDGE VALUE, not a node key — validate the scalar. + if (this._isValueType(meta.params[1].type)) { + this._checkScalarValue(meta.params[1].type, object, `object of '${relation}'`); + } } else if (meta.params.length === 1) { this._checkNodeType(user, meta.params[0].type, 'subject'); } @@ -605,14 +643,16 @@ export class DSLRuntime { // provider, if registered, supplies the edge — checking `owns` directly // must consult the `owns` provider, not only evidence-mediated checks). const required = new Set(this.requiredFacts(relation)); - if (meta && meta.kind === 'fact') required.add(relation); + if (meta && (meta.kind === 'fact' || meta.kind === 'source')) required.add(relation); const requiredList = [...required]; const providers = { ...this.factProviders, ...(options.factProviders || {}) }; const maxRounds = options.maxProviderRounds ?? 3; const partialRelations = []; const injectedRelations = []; // { relation, edges, round } const missingFacts = []; + const warnings = []; const satisfied = new Set(); // facts whose edges are in the partial graph + const now = this.clock ? this.clock() : Date.now(); if (options.partialGraph && Array.isArray(options.partialGraph.relations)) { for (const rel of options.partialGraph.relations) { @@ -678,11 +718,33 @@ export class DSLRuntime { } // A provider may return edges for relations other than its own; the - // injected relation names satisfy those facts too (fixed point). + // injected relation names satisfy those facts too (fixed point). Apply + // the source recency gate (within X) and drop ghost-node edges. + const accepted = []; for (const normalized of edges) { const injectedRelation = normalized.relation ?? fact; - partialRelations.push({ relation: injectedRelation, ...normalized }); - satisfied.add(injectedRelation); + if (factMeta.kind === 'source' && factMeta.withinMs !== null && factMeta.withinMs !== undefined) { + if (normalized.value === undefined) { + throw new Error(`DSLRuntime: provider for recency-gated source '${fact}' must return a timestamp in value (within ${factMeta.withinMs}ms)`); + } + if (now - normalized.value > factMeta.withinMs) { + missingFacts.push({ relation: fact, reason: 'stale' }); + continue; + } + } + if (normalized.src !== undefined && !this.arbiter.nodeIdByKey.has(normalized.src)) { + warnings.push(`provider for '${fact}' returned an edge with unknown source node '${normalized.src}' — dropped`); + continue; + } + if (normalized.dst !== undefined && !this.arbiter.nodeIdByKey.has(normalized.dst)) { + warnings.push(`provider for '${fact}' returned an edge with unknown target node '${normalized.dst}' — dropped`); + continue; + } + accepted.push({ relation: injectedRelation, ...normalized }); + } + for (const normalized of accepted) { + partialRelations.push(normalized); + satisfied.add(normalized.relation); } injectedRelations.push({ relation: fact, edges: edges.length, round, cacheHit: fromCache }); newRelationsThisRound += edges.length; @@ -699,13 +761,24 @@ export class DSLRuntime { }; } - const result = this.arbiter.check(user, relation, object, checkOptions); + // A value-typed object parameter means the check object IS the expected + // edge value, not a node key. Value-carrying facts store edges as + // self-edges on the subject, so the underlying check runs on the subject + // with the value carried as a per-check gate (options.expectedValue). + const isValueObject = meta && meta.params.length === 2 && this._isValueType(meta.params[1].type); + const checkObject = isValueObject ? user : object; + if (isValueObject) { + checkOptions.expectedValue = object; + } + + const result = this.arbiter.check(user, relation, checkObject, checkOptions); return { ...result, requiredFacts: requiredList, providedFacts: injectedRelations.map(r => r.relation), - missingFacts + missingFacts, + warnings }; } diff --git a/src/validation/DSLValidation.js b/src/validation/DSLValidation.js index b01e834..c481d84 100644 --- a/src/validation/DSLValidation.js +++ b/src/validation/DSLValidation.js @@ -141,6 +141,22 @@ function validateDefinitions(program, tables, errors, warnings, source) { })); } } + + // Duplicate field names within a definition silently keep the last + // declaration (e.g. `{ id: string id: string }`) — reject loudly instead. + const fieldSeen = new Set(); + for (const field of def.fields || []) { + if (fieldSeen.has(field.name)) { + errors.push(createError({ + message: `Duplicate field '${def.name}.${field.name}'.`, + rule: 'Each field name must be unique within a definition.', + fix: `Remove the duplicate declaration of '${def.name}.${field.name}'.`, + location: findLocation(source, field.name), + context: formatContext(source, findLocation(source, def.name)) + })); + } + fieldSeen.add(field.name); + } } } @@ -1006,6 +1022,31 @@ function formatPegError(error, sourceText, sourceName) { message = 'Missing colon after identifier.'; fix = 'Add ":" between a name and its type.'; rule = 'Types must be declared using name: Type syntax.'; + } else { + // Targeted hints for common declaration mistakes. The peggy error only + // reports "unexpected X"; these heuristics read the source around the + // failure to point at the real constraint. + const offset = error.location?.start?.offset ?? -1; + const before = offset >= 0 ? sourceText.slice(0, offset) : ''; + const tail = before.split(/\n/).pop() || ''; + const lastKeyword = (() => { + const matches = [...before.matchAll(/\b(fact|relation|source|evidence|measure)\b/g)]; + return matches.length ? matches[matches.length - 1][1] : null; + })(); + + if (found === 'w' && lastKeyword === 'fact' || (found === 'w' && lastKeyword === 'relation')) { + message = '`within` is only valid on `source` declarations.'; + fix = 'Move the recency constraint to a `source` declaration, or drop `within` here.'; + rule = 'Only sources accept a `within` freshness constraint.'; + } else if (/\bBEHAVES\b/.test(before) && tail.includes('BEHAVES')) { + message = 'A declaration can carry only one `BEHAVES` clause.'; + fix = 'Choose either a behavior (`BEHAVES AS transitive`) or a TTL (`BEHAVES { ttl 1h }`), not both.'; + rule = '`BEHAVES` may appear at most once per declaration.'; + } else if (found === 'l' && lastKeyword === 'evidence' && sourceText.slice(offset, offset + 5) === 'limit') { + message = '`limit` is only valid on pattern/recursive bodies.'; + fix = 'Move `limit N` onto the pattern itself, e.g. reports_to(user, *m) { ... } limit N.'; + rule = 'Only pattern bodies take a recursion depth limit.'; + } } return createError({ diff --git a/tests/DSLCompiler.test.js b/tests/DSLCompiler.test.js index b58cabb..0a0d687 100644 --- a/tests/DSLCompiler.test.js +++ b/tests/DSLCompiler.test.js @@ -196,6 +196,36 @@ describe('DSL Compiler', () => { assert.ok(invalidResult.errors.length > 0, 'Should have validation errors'); }); + test('Rejects duplicate fields within a definition', () => { + const dupFieldDSL = ` + definition Employee { id: string id: string } + `; + const result = compiler.validate(dupFieldDSL); + assert.ok(!result.success, 'Duplicate field should fail validation'); + assert.match(result.errors[0], /Duplicate field 'Employee.id'/); + }); + + test('Hints at the real constraint for common declaration mistakes', () => { + const withinOnFact = compiler.compile(` + definition Employee { id: string? } + fact owns(user: Employee, doc: Employee) within 1h + `, 'err-within'); + assert.match(withinOnFact.errors[0], /within.*only valid on `source`/); + + const doubleBehaves = compiler.compile(` + definition Employee { id: string? } + fact rel(user: Employee, doc: Employee) BEHAVES AS transitive BEHAVES { ttl 1h } + `, 'err-behaves'); + assert.match(doubleBehaves.errors[0], /only one `BEHAVES` clause/); + + const limitAfterBody = compiler.compile(` + definition Employee { id: string? } + fact owns(user: Employee, doc: Employee) + evidence can_read(user: Employee, doc: Employee) { owns(user, doc) } limit 5 + `, 'err-limit'); + assert.match(limitAfterBody.errors[0], /`limit` is only valid on pattern/); + }); + test('Rule generation', () => { const dsl = ` definition Employee { diff --git a/tests/DSLRuntime.test.js b/tests/DSLRuntime.test.js index 7ab24b8..666e6d6 100644 --- a/tests/DSLRuntime.test.js +++ b/tests/DSLRuntime.test.js @@ -205,4 +205,123 @@ describe('DSLRuntime', () => { // evidence's requirements, alongside the edge-traversal fact. assert.deepEqual(rt.requiredFacts('can_via'), ['member_of', 'can_view', 'banned']); }); + + it('negates a NOT predicate (1 - possibility)', async () => { + const dsl = ` + definition Employee { id: string? } + fact banned(user: Employee) + evidence can_enter(user: Employee) { NOT banned(user) } + `; + // Absent predicate negates to allow. + const absent = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-not-absent'); + absent.addNode('u:1', 'Employee', {}); + assert.equal((await absent.check('u:1', 'can_enter', 'u:1')).possibility, 1); + // Present predicate negates to its complement. + const present = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-not-present'); + present.addNode('u:1', 'Employee', {}); + present.addRelation('u:1', 'banned', 'u:1', { possibility: 0.9 }); + const denied = await present.check('u:1', 'can_enter', 'u:1'); + assert.ok(Math.abs(denied.possibility - 0.1) < 1e-9, `expected 0.1, got ${denied.possibility}`); + // Nested inside an AND: the negated child still scopes to the subject. + const nested = new DSLRuntime(new Arbiter()).compile(` + definition Employee { id: string? } + definition Doc { id: string? } + fact owns(user: Employee, doc: Doc) + fact banned(user: Employee) + evidence can_open(user: Employee, doc: Doc) { owns(user, doc) NOT banned(user) } + `, 'rt-not-nested'); + nested.addNode('u:1', 'Employee', {}); + nested.addNode('doc:9', 'Doc', {}); + nested.addRelation('u:1', 'owns', 'doc:9', { possibility: 0.8 }); + nested.addRelation('u:1', 'banned', 'u:1', { possibility: 0.6 }); + assert.equal((await nested.check('u:1', 'can_open', 'doc:9')).possibility, 0.4); + }); + + it('resolves BEHAVES AS transitive facts as bounded transitive closure', async () => { + const dsl = ` + definition Employee { id: string? } + fact reports_to(user: Employee, boss: Employee) BEHAVES AS transitive + evidence can_see(user: Employee, doc: Employee) { reports_to(user, doc) } + `; + const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-transitive'); + ['e:1', 'e:2', 'e:3', 'e:4'].forEach(k => rt.addNode(k, 'Employee', {})); + rt.addRelation('e:1', 'reports_to', 'e:2', { possibility: 1.0 }); + rt.addRelation('e:2', 'reports_to', 'e:3', { possibility: 0.9 }); + rt.addRelation('e:3', 'reports_to', 'e:4', { possibility: 0.8 }); + // Direct checks on the transitive fact follow multi-hop paths. + assert.equal((await rt.check('e:1', 'reports_to', 'e:3')).possibility, 0.9); + assert.equal((await rt.check('e:1', 'reports_to', 'e:4')).possibility, 0.8); + // Reverse direction does not grant. + assert.equal((await rt.check('e:2', 'reports_to', 'e:1')).possibility, 0); + // Evidence references inherit the closure. + assert.equal((await rt.check('e:1', 'can_see', 'e:4')).possibility, 0.8); + // Non-transitive facts stay direct-only. + const direct = new DSLRuntime(new Arbiter()).compile(` + definition Employee { id: string? } + fact knows(user: Employee, peer: Employee) + evidence can_ping(user: Employee, doc: Employee) { knows(user, doc) } + `, 'rt-nontransitive'); + ['a:1', 'a:2', 'a:3'].forEach(k => direct.addNode(k, 'Employee', {})); + direct.addRelation('a:1', 'knows', 'a:2', { possibility: 1.0 }); + direct.addRelation('a:2', 'knows', 'a:3', { possibility: 1.0 }); + assert.equal((await direct.check('a:1', 'can_ping', 'a:3')).possibility, 0); + }); + + it('bounds transitive closure depth by the fact limit', async () => { + const rt = new DSLRuntime(new Arbiter()).compile(` + definition Employee { id: string? } + fact reports_to(user: Employee, boss: Employee) BEHAVES AS transitive limit 2 + evidence can_see(user: Employee, doc: Employee) { reports_to(user, doc) } + `, 'rt-transitive-limit'); + ['e:1', 'e:2', 'e:3', 'e:4'].forEach(k => rt.addNode(k, 'Employee', {})); + rt.addRelation('e:1', 'reports_to', 'e:2', { possibility: 1.0 }); + rt.addRelation('e:2', 'reports_to', 'e:3', { possibility: 1.0 }); + rt.addRelation('e:3', 'reports_to', 'e:4', { possibility: 1.0 }); + assert.equal((await rt.check('e:1', 'can_see', 'e:3')).possibility, 1.0); + assert.equal((await rt.check('e:1', 'can_see', 'e:4')).possibility, 0); + }); + + it('retrieves sources through providers and gates them by within recency', async () => { + const rt = new DSLRuntime(new Arbiter()).compile(` + definition Employee { id: string? } + definition Doc { id: string? } + source *session(user: Employee) within 1h + fact *owns(user: Employee, doc: Doc) + evidence can_read(user: Employee, doc: Doc) { session(user) owns(user, doc) } + `, 'rt-source'); + rt.addNode('u:1', 'Employee', {}); + rt.addNode('doc:9', 'Doc', {}); + assert.ok(rt.relations.has('session')); + assert.equal(rt.relations.get('session').kind, 'source'); + assert.equal(rt.relations.get('session').withinMs, 3_600_000); + // A fresh session proof grants. + const fresh = await rt.check('u:1', 'can_read', 'doc:9', { + factProviders: { session: async () => ({ possibility: 1.0, value: Date.now() }), owns: async () => 0.9 } + }); + assert.equal(fresh.possibility, 0.9); + assert.deepEqual(fresh.providedFacts, ['session', 'owns']); + // A stale proof (2h old, beyond the 1h window) denies as stale. + const stale = await rt.check('u:1', 'can_read', 'doc:9', { + factProviders: { session: async () => ({ possibility: 1.0, value: Date.now() - 2 * 3600_000 }), owns: async () => 0.9 } + }); + assert.equal(stale.possibility, 0); + assert.deepEqual(stale.missingFacts, [{ relation: 'session', reason: 'stale' }]); + }); + + it('warns about and drops provider edges referencing unknown nodes', async () => { + const rt = new DSLRuntime(new Arbiter()).compile(` + definition Employee { id: string? } + definition Doc { id: string? } + fact *owns(user: Employee, doc: Doc) + evidence can_read(user: Employee, doc: Doc) { owns(user, doc) } + `, 'rt-ghost'); + rt.addNode('u:1', 'Employee', {}); + rt.addNode('doc:9', 'Doc', {}); + const res = await rt.check('u:1', 'can_read', 'doc:9', { + factProviders: { owns: async () => [{ src: 'ghost:1', dst: 'doc:9', possibility: 0.9 }] } + }); + assert.equal(res.possibility, 0); + assert.equal(res.warnings.length, 1); + assert.match(res.warnings[0], /unknown source node 'ghost:1'/); + }); }); diff --git a/tests/DSLRuntimeExt.test.js b/tests/DSLRuntimeExt.test.js index 37f03ce..8dd6c06 100644 --- a/tests/DSLRuntimeExt.test.js +++ b/tests/DSLRuntimeExt.test.js @@ -165,4 +165,33 @@ describe('DSLRuntime extended', () => { assert.equal(missed.possibility, 0); assert.deepEqual(missed.missingFacts, [{ relation: 'owns', reason: 'no_provider' }]); }); + + it('recompiling a scope uninstalls its stale relation configs', async () => { + const rt = new DSLRuntime(new Arbiter()); + rt.compile(` + definition Employee { id: string? } + definition Doc { id: string? } + fact owns(user: Employee, doc: Doc) + evidence can_read(user: Employee, doc: Doc) { owns(user, doc) } + `, 'rt-stale'); + rt.addNode('u:1', 'Employee', {}); + rt.addNode('doc:9', 'Doc', {}); + rt.addRelation('u:1', 'owns', 'doc:9', { possibility: 1.0 }); + assert.equal(rt.arbiter.check('u:1', 'can_read', 'doc:9').possibility, 1.0); + + // Recompile the SAME scope with a different program: can_read/owns are no + // longer declared and must not keep granting. A second scope's relations + // would be unaffected (compileMultiple coexistence). + rt.compile(` + definition Employee { id: string? } + definition Doc { id: string? } + fact shares(user: Employee, doc: Doc) + evidence can_share(user: Employee, doc: Doc) { shares(user, doc) } + `, 'rt-stale'); + const stale = rt.arbiter.check('u:1', 'can_read', 'doc:9'); + assert.equal(stale.possibility, 0, 'revoked can_read must not keep granting'); + assert.ok(!rt.arbiter.relationConfigs.has('can_read')); + assert.ok(!rt.arbiter.relationConfigs.has('owns')); + assert.ok(rt.arbiter.relationConfigs.has('can_share')); + }); }); diff --git a/tests/DSLRuntimeTyping.test.js b/tests/DSLRuntimeTyping.test.js index 8120ab0..82c6790 100644 --- a/tests/DSLRuntimeTyping.test.js +++ b/tests/DSLRuntimeTyping.test.js @@ -93,4 +93,44 @@ describe('DSLRuntime typing', () => { rt.registerFact('owns', async () => ({ possibility: 2.0 })); await assert.rejects(() => rt.check('u:1', 'can_read', 'doc:9'), /invalid possibility/); }); + + it('enforces a literal value in evidence as an exact edge-value gate', async () => { + const rt = new DSLRuntime(new Arbiter()).compile(` + definition Employee { id: string? } + fact balance(user: Employee, amount: number) + evidence can_afford(user: Employee) { balance(user, 5) } + `, 'rt-expected-value'); + rt.addNode('u:1', 'Employee', {}); + // An edge carrying amount 3 must NOT satisfy balance(user, 5) — without the + // gate every balance edge matched regardless of amount (silent over-grant). + rt.addRelation('u:1', 'balance', 'u:1', { possibility: 1.0, value: 3 }); + const denied = await rt.check('u:1', 'can_afford', 'u:1'); + assert.equal(denied.possibility, 0, 'value-3 edge must not satisfy balance(user, 5)'); + rt.addRelation('u:1', 'balance', 'u:1', { possibility: 0.8, value: 5 }); + const granted = await rt.check('u:1', 'can_afford', 'u:1'); + assert.equal(granted.possibility, 0.8, 'value-5 edge must satisfy balance(user, 5)'); + }); + + it('treats a value-typed evidence OBJECT param as the expected edge value', async () => { + const rt = new DSLRuntime(new Arbiter()).compile(` + definition Employee { id: string? } + fact balance(user: Employee, amount: number) + evidence can_withdraw(user: Employee, amount: number) { balance(user, amount) } + `, 'rt-value-object'); + rt.addNode('u:1', 'Employee', {}); + rt.addRelation('u:1', 'balance', 'u:1', { possibility: 0.9, value: 5 }); + // The check object is the VALUE, not a node key: grant only on exact match. + const granted = await rt.check('u:1', 'can_withdraw', 5); + assert.equal(granted.possibility, 0.9, 'value-5 check must match the value-5 edge'); + const denied = await rt.check('u:1', 'can_withdraw', 3); + assert.equal(denied.possibility, 0, 'value-3 check must not match the value-5 edge'); + // Re-checking the granted value must not hit a value-3 cache entry. + const again = await rt.check('u:1', 'can_withdraw', 5); + assert.equal(again.possibility, 0.9, 'value-5 re-check must not be served the value-3 result'); + // Direct fact check with a value object works the same way. + const direct = await rt.check('u:1', 'balance', 5); + assert.equal(direct.possibility, 0.9, 'direct balance(user, 5) must match the value-5 edge'); + // A non-scalar object for a value-typed param is rejected loudly. + await assert.rejects(() => rt.check('u:1', 'can_withdraw', 'u:1'), /must be number/); + }); });