add more

src/Auth/PolicyChecker.php

@@ -22,7 +22,7 @@ final class PolicyChecker
             if (($policy['protocol'] ?? 'tcp') !== $protocol) {
                 continue;
             }
-            if (!in_array($port, $policy['target_ports'] ?? [], true)) {
+            if (!PortMatcher::matches($port, $policy['target_ports'] ?? [])) {
                 continue;
             }
             if (!$this->hostMatches($host, $policy['target_hosts'] ?? [])) {

src/Auth/PortMatcher.php

@@ -0,0 +1,47 @@
+<?php
+
+declare(strict_types=1);
+
+namespace LayLink\Auth;
+
+final class PortMatcher
+{
+    public static function matches(int $port, array $rules): bool
+    {
+        foreach ($rules as $rule) {
+            if (is_int($rule) && $rule === $port) {
+                return true;
+            }
+
+            if (is_string($rule) && self::stringRuleMatches($port, $rule)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private static function stringRuleMatches(int $port, string $rule): bool
+    {
+        $rule = trim($rule);
+        if ($rule === '') {
+            return false;
+        }
+
+        if (ctype_digit($rule)) {
+            return (int)$rule === $port;
+        }
+
+        if (!preg_match('/^(\d{1,5})\s*-\s*(\d{1,5})$/', $rule, $matches)) {
+            return false;
+        }
+
+        $start = (int)$matches[1];
+        $end = (int)$matches[2];
+        if ($start < 1 || $end > 65535 || $start > $end) {
+            return false;
+        }
+
+        return $port >= $start && $port <= $end;
+    }
+}