@nanolink/policy-common

Aerospike policy access models plus a small read-only client and access resolver helpers.

Install

npm install @nanolink/policy-common

Scripts

• npm run build – compile to dist
• npm test / npm run test:watch
• npm run lint
• npm start – build then run dist/index.js

Core exports

• Models and bin/set/key helpers under src/models/*
• AerospikePolicyClient – typed wrappers to read policy records
• AccessResolver – per-user helper to answer "does this user have access?" for references/trackers

Example: client usage

import { AerospikePolicyClient, PolicyAccessLevel } from '@nanolink/policy-common';
import { ObjectId } from 'bson';

const client = new AerospikePolicyClient({ namespace: 'test', hosts: '127.0.0.1:3000' });
await client.connect();

const groupAccess = await client.getGroupAccess(new ObjectId('64c...'), new ObjectId('64d...'));
if (groupAccess && groupAccess.accessLevel !== PolicyAccessLevel.None) {
  // user group can access this group
}

const pids = await client.getAccessibleTrackerPids(userGroupId, customerId);
// pids is a Set<string> of tracker PIDs

Notable client methods (all return null when missing):

• getGroupAccess(userGroupId, groupId)
• getGroupReferenceAccess(referenceId, userGroupId)
• getUserReferenceAccess(userId, referenceId)
• getReferenceGroup(referenceId)
• getTrackerGroup(pid)
• getTrackerGroupByVid(vid)
• query... helpers for bulk reads (group access, reference groups, trackers by owner)
• getAccessibleTrackerPids(userGroupId, customerId) – union of tracker PIDs owned by the user group or customer

Example: access resolution

AccessResolver assumes a single user group id for the user.

import { AccessResolver } from '@nanolink/policy-common';
import { ObjectId } from 'bson';

const resolver = new AccessResolver(client, userId, userGroupId);

const refAccess = await resolver.userHasReferenceAccess(referenceId);
// refAccess.hasAccess -> boolean, includes reason and access level

const trackerAccess = await resolver.userHasTrackerAccessByPid('tracker-pid-123');

Resolution order:

1. Direct user->reference allow
2. User group -> reference allow
3. Reference -> owning group, then user group access to that group Trackers: if unbound to a reference, they are allowed; otherwise defer to reference access.

Structure

• src/models/* – interfaces and bin/set/key helpers
• src/aerospikeClient.ts – typed Aerospike read client
• src/accessResolver.ts – access resolution helper
• src/index.ts – public entry point

Publishing

GitHub Actions workflow publish.yml can publish to npm on push/dispatch when configured with NODE_AUTH_TOKEN.