chore: import upstream snapshot with attribution

apps/sim/lib/core/config/appconfig-rules.ts

@@ -0,0 +1,80 @@
+/**
+ * Shared parsing and clause evaluation for AppConfig gating documents
+ * (`feature-flags`, `block-visibility`). Both documents are maps of key →
+ * gate rule with identical rule shapes; this module is the single copy of the
+ * security-sensitive normalization that prevents a malformed document from
+ * granting access. Admin-resolution *scheduling* deliberately stays with the
+ * callers (feature-flags resolves lazily per rule; block-visibility resolves
+ * once per document), so {@link matchesRule} takes an explicit `isAdmin`.
+ */
+
+/**
+ * A single gating rule. A gate is open for a context when ANY clause matches:
+ * the global `enabled` default, the org/user allowlists, or `adminEnabled` for
+ * platform admins. An absent clause never matches.
+ */
+export interface AppConfigGateRule {
+  enabled?: boolean
+  orgIds?: string[]
+  userIds?: string[]
+  adminEnabled?: boolean
+}
+
+/**
+ * Per-request evaluation context. Pass only the ids you have — a missing id
+ * skips its clause. `isAdmin` is a fast-path override for callers that already
+ * resolved platform-admin status.
+ */
+export interface AppConfigGateContext {
+  userId?: string | null
+  orgId?: string | null
+  isAdmin?: boolean
+}
+
+function normalizeIds(values: unknown): string[] | undefined {
+  if (!Array.isArray(values)) return undefined
+  const ids = Array.from(new Set(values.map((v) => String(v).trim()).filter(Boolean)))
+  return ids.length > 0 ? ids : undefined
+}
+
+/** Coerce a single arbitrary JSON value into a rule, or `null` when malformed. */
+export function normalizeRule(value: unknown): AppConfigGateRule | null {
+  if (!value || typeof value !== 'object') return null
+  const obj = value as Record<string, unknown>
+  const rule: AppConfigGateRule = {}
+  if (typeof obj.enabled === 'boolean') rule.enabled = obj.enabled
+  if (typeof obj.adminEnabled === 'boolean') rule.adminEnabled = obj.adminEnabled
+  const orgIds = normalizeIds(obj.orgIds)
+  if (orgIds) rule.orgIds = orgIds
+  const userIds = normalizeIds(obj.userIds)
+  if (userIds) rule.userIds = userIds
+  return rule
+}
+
+/** Coerce an arbitrary AppConfig/JSON document into a rule map, dropping malformed entries. */
+export function parseGateConfig(json: unknown): Record<string, AppConfigGateRule> {
+  const obj = (json && typeof json === 'object' ? json : {}) as Record<string, unknown>
+  const rules: Record<string, AppConfigGateRule> = {}
+  for (const [key, value] of Object.entries(obj)) {
+    const rule = normalizeRule(value)
+    if (rule) rules[key] = rule
+  }
+  return rules
+}
+
+/**
+ * Pure OR-of-clauses check. The caller supplies `isAdmin` — pass `false` to
+ * evaluate only the non-admin clauses (for lazy admin resolution).
+ */
+export function matchesRule(
+  rule: AppConfigGateRule | undefined,
+  ctx: AppConfigGateContext,
+  isAdmin: boolean
+): boolean {
+  if (!rule) return false
+  if (rule.enabled) return true
+  if (ctx.userId && rule.userIds?.includes(ctx.userId)) return true
+  if (ctx.orgId && rule.orgIds?.includes(ctx.orgId)) return true
+  if (rule.adminEnabled && isAdmin) return true
+  return false
+}