/** * @fileoverview Safe expression evaluator for conditional logic in MemberJunction. * * This module provides a secure way to evaluate boolean expressions against * context objects without allowing arbitrary code execution. It supports * dot notation for nested property access and common comparison operations. * * @module @memberjunction/global * @author MemberJunction.com * @since 2.76.0 */ /** * Result of expression evaluation including success status and diagnostics */ export interface ExpressionEvaluationResult { success: boolean; value?: boolean; error?: string; diagnostics?: { expression: string; context: Record; evaluationTime: number; }; } /** * Safe expression evaluator that prevents arbitrary code execution while * supporting common boolean expressions and property access patterns. * * Supported operations: * - Comparison: ==, ===, !=, !==, <, >, <=, >= * - Logical: &&, ||, ! * - Property access: dot notation (e.g., payload.customer.name) * - Array access: bracket notation (e.g., items[0]) * - Safe methods: .length, .includes(), .startsWith(), .endsWith() * - Array methods: .some(), .every(), .find(), .filter() * - Type checking: typeof, instanceof (limited to safe types) * * @class SafeExpressionEvaluator * * @example * ```typescript * const evaluator = new SafeExpressionEvaluator(); * * // Simple comparison * const result1 = evaluator.evaluate( * "status == 'active'", * { status: 'active' } * ); * * // Nested property access * const result2 = evaluator.evaluate( * "payload.customer.tier == 'premium' && payload.order.total > 1000", * { payload: { customer: { tier: 'premium' }, order: { total: 1500 } } } * ); * * // Array methods * const result3 = evaluator.evaluate( * "items.some(item => item.price > 100)", * { items: [{ price: 50 }, { price: 150 }] } * ); * ``` */ export declare class SafeExpressionEvaluator { /** * Patterns that indicate potentially dangerous code * @private */ private static readonly DANGEROUS_PATTERNS; /** * Cache for compiled expressions to improve performance on repeated evaluations * @private */ private readonly _compiledExpressionCache; /** * Safe methods that can be called on objects * @private */ private static readonly SAFE_METHODS; /** * Evaluates a boolean expression against a context object * * @param {string} expression - The boolean expression to evaluate * @param {Record} context - The context object containing variables * @param {boolean} [enableDiagnostics=false] - Whether to include diagnostic information * * @returns {ExpressionEvaluationResult} The evaluation result */ evaluate(expression: string, context: Record, enableDiagnostics?: boolean): ExpressionEvaluationResult; /** * Validates an expression for safety * * @param {string} expression - The expression to validate * * @returns {string | null} Error message if invalid, null if valid * * @private */ private validateExpression; /** * Creates a safe context object with only allowed properties * * @param {Record} context - The original context * * @returns {Record} The safe context * * @private */ private createSafeContext; /** * Checks if a property name is potentially dangerous * * @param {string} name - The property name * * @returns {boolean} True if dangerous * * @private */ private isDangerousPropertyName; /** * Safely clones a value for use in evaluation context * * @param {any} value - The value to clone * * @returns {any} The cloned value * * @private */ private cloneValue; /** * Evaluates multiple expressions and returns all results * * @param {Array<{expression: string, name?: string}>} expressions - Array of expressions to evaluate * @param {Record} context - The context object * * @returns {Record} Map of results by name or index */ evaluateMultiple(expressions: Array<{ expression: string; name?: string; }>, context: Record): Record; } /** * Default instance for convenience */ export declare const defaultExpressionEvaluator: SafeExpressionEvaluator; //# sourceMappingURL=SafeExpressionEvaluator.d.ts.map