modkit_security/
access_scope.rs

1use std::fmt;
2use uuid::Uuid;
3
4/// A scalar value for scope filtering.
5///
6/// Used in [`ScopeFilter`] predicates to represent typed values.
7/// JSON conversion happens at the PDP/PEP boundary (see the PEP compiler),
8/// not inside the security model.
9#[derive(Clone, Debug, PartialEq, Eq, Hash)]
10pub enum ScopeValue {
11    /// UUID value (tenant IDs, resource IDs, etc.)
12    Uuid(Uuid),
13    /// String value (status, GTS type IDs, etc.)
14    String(String),
15    /// Integer value.
16    Int(i64),
17    /// Boolean value.
18    Bool(bool),
19}
20
21impl ScopeValue {
22    /// Try to extract a UUID from this value.
23    ///
24    /// Returns `Some` for `ScopeValue::Uuid` directly, and for
25    /// `ScopeValue::String` if the string is a valid UUID.
26    #[must_use]
27    pub fn as_uuid(&self) -> Option<Uuid> {
28        match self {
29            Self::Uuid(u) => Some(*u),
30            Self::String(s) => Uuid::parse_str(s).ok(),
31            Self::Int(_) | Self::Bool(_) => None,
32        }
33    }
34}
35
36impl fmt::Display for ScopeValue {
37    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
38        match self {
39            Self::Uuid(u) => write!(f, "{u}"),
40            Self::String(s) => write!(f, "{s}"),
41            Self::Int(n) => write!(f, "{n}"),
42            Self::Bool(b) => write!(f, "{b}"),
43        }
44    }
45}
46
47impl From<Uuid> for ScopeValue {
48    #[inline]
49    fn from(u: Uuid) -> Self {
50        Self::Uuid(u)
51    }
52}
53
54impl From<&Uuid> for ScopeValue {
55    #[inline]
56    fn from(u: &Uuid) -> Self {
57        Self::Uuid(*u)
58    }
59}
60
61impl From<String> for ScopeValue {
62    #[inline]
63    fn from(s: String) -> Self {
64        Self::String(s)
65    }
66}
67
68impl From<&str> for ScopeValue {
69    #[inline]
70    fn from(s: &str) -> Self {
71        Self::String(s.to_owned())
72    }
73}
74
75impl From<i64> for ScopeValue {
76    #[inline]
77    fn from(n: i64) -> Self {
78        Self::Int(n)
79    }
80}
81
82impl From<bool> for ScopeValue {
83    #[inline]
84    fn from(b: bool) -> Self {
85        Self::Bool(b)
86    }
87}
88
89/// Well-known authorization property names.
90///
91/// These constants are shared between the PEP compiler and the ORM condition
92/// builder (`ScopableEntity::resolve_property()`), ensuring a single source of
93/// truth for property names.
94pub mod pep_properties {
95    /// Tenant-ownership property. Typically maps to the `tenant_id` column.
96    pub const OWNER_TENANT_ID: &str = "owner_tenant_id";
97
98    /// Resource identity property. Typically maps to the primary key column.
99    pub const RESOURCE_ID: &str = "id";
100
101    /// Owner (user) identity property. Typically maps to an `owner_id` column.
102    pub const OWNER_ID: &str = "owner_id";
103}
104
105/// A single scope filter — a typed predicate on a named resource property.
106///
107/// The property name (e.g., `"owner_tenant_id"`, `"id"`) is an authorization
108/// concept. Mapping to DB columns is done by `ScopableEntity::resolve_property()`.
109///
110/// Variants mirror the predicate types from the PDP response:
111/// - [`ScopeFilter::Eq`] — equality (`property = value`)
112/// - [`ScopeFilter::In`] — set membership (`property IN (values)`)
113///
114/// ## Future extensions
115///
116/// Additional filter types (`in_tenant_subtree`, `in_group`,
117/// `in_group_subtree`) are planned. See the authorization design document
118/// (`docs/arch/authorization/DESIGN.md`) for the full predicate taxonomy.
119#[derive(Clone, Debug, PartialEq, Eq)]
120pub enum ScopeFilter {
121    /// Equality: `property = value`.
122    Eq(EqScopeFilter),
123    /// Set membership: `property IN (values)`.
124    In(InScopeFilter),
125}
126
127/// Equality scope filter: `property = value`.
128#[derive(Clone, Debug, PartialEq, Eq, Hash)]
129pub struct EqScopeFilter {
130    /// Authorization property name (e.g., `pep_properties::OWNER_TENANT_ID`).
131    property: String,
132    /// The value to match.
133    value: ScopeValue,
134}
135
136/// Set membership scope filter: `property IN (values)`.
137#[derive(Clone, Debug, PartialEq, Eq)]
138pub struct InScopeFilter {
139    /// Authorization property name (e.g., `pep_properties::OWNER_TENANT_ID`).
140    property: String,
141    /// The set of values to match against.
142    values: Vec<ScopeValue>,
143}
144
145impl EqScopeFilter {
146    /// Create an equality scope filter.
147    #[must_use]
148    pub fn new(property: impl Into<String>, value: impl Into<ScopeValue>) -> Self {
149        Self {
150            property: property.into(),
151            value: value.into(),
152        }
153    }
154
155    /// The authorization property name.
156    #[inline]
157    #[must_use]
158    pub fn property(&self) -> &str {
159        &self.property
160    }
161
162    /// The filter value.
163    #[inline]
164    #[must_use]
165    pub fn value(&self) -> &ScopeValue {
166        &self.value
167    }
168}
169
170impl InScopeFilter {
171    /// Create a set membership scope filter.
172    #[must_use]
173    pub fn new(property: impl Into<String>, values: Vec<ScopeValue>) -> Self {
174        Self {
175            property: property.into(),
176            values,
177        }
178    }
179
180    /// Create from an iterator of convertible values.
181    #[must_use]
182    pub fn from_values<V: Into<ScopeValue>>(
183        property: impl Into<String>,
184        values: impl IntoIterator<Item = V>,
185    ) -> Self {
186        Self {
187            property: property.into(),
188            values: values.into_iter().map(Into::into).collect(),
189        }
190    }
191
192    /// The authorization property name.
193    #[inline]
194    #[must_use]
195    pub fn property(&self) -> &str {
196        &self.property
197    }
198
199    /// The filter values.
200    #[inline]
201    #[must_use]
202    pub fn values(&self) -> &[ScopeValue] {
203        &self.values
204    }
205}
206
207impl ScopeFilter {
208    /// Create an equality filter (`property = value`).
209    #[must_use]
210    pub fn eq(property: impl Into<String>, value: impl Into<ScopeValue>) -> Self {
211        Self::Eq(EqScopeFilter::new(property, value))
212    }
213
214    /// Create a set membership filter (`property IN (values)`).
215    #[must_use]
216    pub fn r#in(property: impl Into<String>, values: Vec<ScopeValue>) -> Self {
217        Self::In(InScopeFilter::new(property, values))
218    }
219
220    /// Create a set membership filter from UUID values (convenience).
221    #[must_use]
222    pub fn in_uuids(property: impl Into<String>, uuids: Vec<Uuid>) -> Self {
223        Self::In(InScopeFilter::new(
224            property,
225            uuids.into_iter().map(ScopeValue::Uuid).collect(),
226        ))
227    }
228
229    /// The authorization property name.
230    #[must_use]
231    pub fn property(&self) -> &str {
232        match self {
233            Self::Eq(f) => f.property(),
234            Self::In(f) => f.property(),
235        }
236    }
237
238    /// Collect all values as a slice-like view for iteration.
239    ///
240    /// For `Eq`, returns a single-element slice; for `In`, returns the values slice.
241    #[must_use]
242    pub fn values(&self) -> ScopeFilterValues<'_> {
243        match self {
244            Self::Eq(f) => ScopeFilterValues::Single(&f.value),
245            Self::In(f) => ScopeFilterValues::Multiple(&f.values),
246        }
247    }
248
249    /// Extract filter values as UUIDs, skipping non-UUID entries.
250    ///
251    /// Useful when the caller knows the property holds UUID values
252    /// (e.g., `owner_tenant_id`, `id`).
253    #[must_use]
254    pub fn uuid_values(&self) -> Vec<Uuid> {
255        self.values()
256            .iter()
257            .filter_map(ScopeValue::as_uuid)
258            .collect()
259    }
260}
261
262/// Iterator adapter for [`ScopeFilter::values()`].
263///
264/// Provides a uniform way to iterate over filter values regardless of
265/// whether the filter is `Eq` (single value) or `In` (multiple values).
266#[derive(Clone, Debug)]
267pub enum ScopeFilterValues<'a> {
268    /// Single value from an `Eq` filter.
269    Single(&'a ScopeValue),
270    /// Multiple values from an `In` filter.
271    Multiple(&'a [ScopeValue]),
272}
273
274impl<'a> ScopeFilterValues<'a> {
275    /// Returns an iterator over the values.
276    #[must_use]
277    pub fn iter(&self) -> ScopeFilterValuesIter<'a> {
278        match self {
279            Self::Single(v) => ScopeFilterValuesIter::Single(Some(v)),
280            Self::Multiple(vs) => ScopeFilterValuesIter::Multiple(vs.iter()),
281        }
282    }
283
284    /// Returns `true` if any value matches the given predicate.
285    #[must_use]
286    pub fn contains(&self, value: &ScopeValue) -> bool {
287        self.iter().any(|v| v == value)
288    }
289}
290
291impl<'a> IntoIterator for ScopeFilterValues<'a> {
292    type Item = &'a ScopeValue;
293    type IntoIter = ScopeFilterValuesIter<'a>;
294
295    fn into_iter(self) -> Self::IntoIter {
296        self.iter()
297    }
298}
299
300impl<'a> IntoIterator for &ScopeFilterValues<'a> {
301    type Item = &'a ScopeValue;
302    type IntoIter = ScopeFilterValuesIter<'a>;
303
304    fn into_iter(self) -> Self::IntoIter {
305        self.iter()
306    }
307}
308
309/// Iterator over [`ScopeFilterValues`].
310pub enum ScopeFilterValuesIter<'a> {
311    /// Yields a single value.
312    Single(Option<&'a ScopeValue>),
313    /// Yields from a slice.
314    Multiple(std::slice::Iter<'a, ScopeValue>),
315}
316
317impl<'a> Iterator for ScopeFilterValuesIter<'a> {
318    type Item = &'a ScopeValue;
319
320    fn next(&mut self) -> Option<Self::Item> {
321        match self {
322            Self::Single(v) => v.take(),
323            Self::Multiple(iter) => iter.next(),
324        }
325    }
326}
327
328/// A conjunction (AND) of scope filters — one access path.
329///
330/// All filters within a constraint must match simultaneously for a row
331/// to be accessible via this path.
332#[derive(Clone, Debug, PartialEq)]
333pub struct ScopeConstraint {
334    filters: Vec<ScopeFilter>,
335}
336
337impl ScopeConstraint {
338    /// Create a new scope constraint from a list of filters.
339    #[must_use]
340    pub fn new(filters: Vec<ScopeFilter>) -> Self {
341        Self { filters }
342    }
343
344    /// The filters in this constraint (AND-ed together).
345    #[inline]
346    #[must_use]
347    pub fn filters(&self) -> &[ScopeFilter] {
348        &self.filters
349    }
350
351    /// Returns `true` if this constraint has no filters.
352    #[inline]
353    #[must_use]
354    pub fn is_empty(&self) -> bool {
355        self.filters.is_empty()
356    }
357}
358
359/// A disjunction (OR) of scope constraints defining what data is accessible.
360///
361/// Each constraint is an independent access path (OR-ed). Filters within a
362/// constraint are AND-ed. An unconstrained scope bypasses row-level filtering.
363///
364/// # Examples
365///
366/// ```
367/// use modkit_security::access_scope::{AccessScope, ScopeConstraint, ScopeFilter, pep_properties};
368/// use uuid::Uuid;
369///
370/// // deny-all (default)
371/// let scope = AccessScope::deny_all();
372/// assert!(scope.is_deny_all());
373///
374/// // single tenant
375/// let tid = Uuid::new_v4();
376/// let scope = AccessScope::for_tenant(tid);
377/// assert!(!scope.is_deny_all());
378/// assert!(scope.contains_uuid(pep_properties::OWNER_TENANT_ID, tid));
379/// ```
380#[derive(Clone, Debug, PartialEq)]
381pub struct AccessScope {
382    constraints: Vec<ScopeConstraint>,
383    unconstrained: bool,
384}
385
386impl Default for AccessScope {
387    /// Default is deny-all: no constraints and not unconstrained.
388    fn default() -> Self {
389        Self::deny_all()
390    }
391}
392
393impl AccessScope {
394    // ── Constructors ────────────────────────────────────────────────
395
396    /// Create an access scope from a list of constraints (OR-ed).
397    #[must_use]
398    pub fn from_constraints(constraints: Vec<ScopeConstraint>) -> Self {
399        Self {
400            constraints,
401            unconstrained: false,
402        }
403    }
404
405    /// Create an access scope with a single constraint.
406    #[must_use]
407    pub fn single(constraint: ScopeConstraint) -> Self {
408        Self::from_constraints(vec![constraint])
409    }
410
411    /// Create an "allow all" (unconstrained) scope.
412    ///
413    /// This represents a legitimate PDP decision with no row-level filtering.
414    /// Not a bypass — it's a valid authorization outcome.
415    #[must_use]
416    pub fn allow_all() -> Self {
417        Self {
418            constraints: Vec::new(),
419            unconstrained: true,
420        }
421    }
422
423    /// Create a "deny all" scope (no access).
424    #[must_use]
425    pub fn deny_all() -> Self {
426        Self {
427            constraints: Vec::new(),
428            unconstrained: false,
429        }
430    }
431
432    // ── Convenience constructors ────────────────────────────────────
433
434    /// Create a scope for a set of tenant IDs.
435    #[must_use]
436    pub fn for_tenants(ids: Vec<Uuid>) -> Self {
437        Self::single(ScopeConstraint::new(vec![ScopeFilter::in_uuids(
438            pep_properties::OWNER_TENANT_ID,
439            ids,
440        )]))
441    }
442
443    /// Create a scope for a single tenant ID.
444    #[must_use]
445    pub fn for_tenant(id: Uuid) -> Self {
446        Self::for_tenants(vec![id])
447    }
448
449    /// Create a scope for a set of resource IDs.
450    #[must_use]
451    pub fn for_resources(ids: Vec<Uuid>) -> Self {
452        Self::single(ScopeConstraint::new(vec![ScopeFilter::in_uuids(
453            pep_properties::RESOURCE_ID,
454            ids,
455        )]))
456    }
457
458    /// Create a scope for a single resource ID.
459    #[must_use]
460    pub fn for_resource(id: Uuid) -> Self {
461        Self::for_resources(vec![id])
462    }
463
464    // ── Accessors ───────────────────────────────────────────────────
465
466    /// The constraints in this scope (OR-ed).
467    #[inline]
468    #[must_use]
469    pub fn constraints(&self) -> &[ScopeConstraint] {
470        &self.constraints
471    }
472
473    /// Returns `true` if this scope is unconstrained (allow-all).
474    #[inline]
475    #[must_use]
476    pub fn is_unconstrained(&self) -> bool {
477        self.unconstrained
478    }
479
480    /// Returns `true` if this scope denies all access.
481    ///
482    /// A scope is deny-all when it is not unconstrained and has no constraints.
483    #[must_use]
484    pub fn is_deny_all(&self) -> bool {
485        !self.unconstrained && self.constraints.is_empty()
486    }
487
488    /// Collect all values for a given property across all constraints.
489    #[must_use]
490    pub fn all_values_for(&self, property: &str) -> Vec<&ScopeValue> {
491        let mut result = Vec::new();
492        for constraint in &self.constraints {
493            for filter in constraint.filters() {
494                if filter.property() == property {
495                    result.extend(filter.values());
496                }
497            }
498        }
499        result
500    }
501
502    /// Collect all UUID values for a given property across all constraints.
503    ///
504    /// Convenience wrapper — skips non-UUID values.
505    #[must_use]
506    pub fn all_uuid_values_for(&self, property: &str) -> Vec<Uuid> {
507        let mut result = Vec::new();
508        for constraint in &self.constraints {
509            for filter in constraint.filters() {
510                if filter.property() == property {
511                    result.extend(filter.uuid_values());
512                }
513            }
514        }
515        result
516    }
517
518    /// Check if any constraint has a filter matching the given property and value.
519    #[must_use]
520    pub fn contains_value(&self, property: &str, value: &ScopeValue) -> bool {
521        self.constraints.iter().any(|c| {
522            c.filters()
523                .iter()
524                .any(|f| f.property() == property && f.values().contains(value))
525        })
526    }
527
528    /// Check if any constraint has a filter matching the given property and UUID.
529    ///
530    /// Matches both `ScopeValue::Uuid` and `ScopeValue::String` variants so
531    /// that UUID-as-string values are treated consistently with
532    /// [`AccessScope::all_uuid_values_for`], which also parses strings via
533    /// [`ScopeValue::as_uuid`].
534    #[must_use]
535    pub fn contains_uuid(&self, property: &str, id: Uuid) -> bool {
536        self.constraints.iter().any(|c| {
537            c.filters().iter().any(|f| {
538                f.property() == property && f.values().iter().any(|v| v.as_uuid() == Some(id))
539            })
540        })
541    }
542
543    /// Check if any constraint references the given property.
544    #[must_use]
545    pub fn has_property(&self, property: &str) -> bool {
546        self.constraints
547            .iter()
548            .any(|c| c.filters().iter().any(|f| f.property() == property))
549    }
550
551    /// Create a new scope retaining only `owner_tenant_id` filters.
552    ///
553    /// Useful for entities declared with `no_owner` (e.g., messages, reactions),
554    /// where `owner_id` constraints cannot be resolved and would cause fail-closed
555    /// deny-all behaviour.
556    ///
557    /// - Unconstrained scopes become deny-all (fail-closed).
558    /// - Constraints that contain no `owner_tenant_id` filter are dropped entirely.
559    /// - If all constraints are dropped, the result is deny-all.
560    #[must_use]
561    pub fn tenant_only(&self) -> Self {
562        self.retain_properties(&[pep_properties::OWNER_TENANT_ID])
563    }
564
565    /// Create a new scope retaining only `owner_tenant_id` and `owner_id` filters.
566    ///
567    /// Useful for entities that have both tenant and owner columns but no
568    /// resource-level constraints (e.g., reactions scoped to the acting user).
569    ///
570    /// - Unconstrained scopes become deny-all (fail-closed).
571    /// - Constraints that contain none of the retained properties are dropped.
572    /// - If all constraints are dropped, the result is deny-all.
573    #[must_use]
574    pub fn tenant_and_owner(&self) -> Self {
575        self.retain_properties(&[pep_properties::OWNER_TENANT_ID, pep_properties::OWNER_ID])
576    }
577
578    /// Create a new scope that guarantees an `owner_id` equality filter
579    /// matching exactly the supplied `owner_id` is present in every constraint.
580    ///
581    /// **Intersection semantics**: if a constraint already contains an
582    /// `owner_id` filter, the supplied value must be among its values —
583    /// otherwise the constraint is dropped. When it matches, the filter is
584    /// narrowed to exactly that single value.
585    ///
586    /// - **Unconstrained** → single constraint with only the `owner_id` filter.
587    /// - **Deny-all** → stays deny-all.
588    /// - **No existing owner filter** → `owner_id` is injected.
589    /// - **Existing owner filter containing `owner_id`** → narrowed to `Eq`.
590    /// - **Existing owner filter NOT containing `owner_id`** → constraint dropped
591    ///   (constraints use OR semantics, so dropping one narrows access; dropping
592    ///   all yields deny-all).
593    ///
594    /// Use this as a defence-in-depth measure for user-owned resources when
595    /// the PDP may not always return `owner_id` constraints or may return a
596    /// broader set than the current subject.
597    #[must_use]
598    pub fn ensure_owner(&self, owner_id: Uuid) -> Self {
599        if self.is_deny_all() {
600            return Self::deny_all();
601        }
602
603        let owner_filter = ScopeFilter::eq(pep_properties::OWNER_ID, owner_id);
604
605        if self.unconstrained {
606            return Self::single(ScopeConstraint::new(vec![owner_filter]));
607        }
608
609        let constraints = self
610            .constraints
611            .iter()
612            .filter_map(|c| {
613                let owner_filters: Vec<&ScopeFilter> = c
614                    .filters()
615                    .iter()
616                    .filter(|f| f.property() == pep_properties::OWNER_ID)
617                    .collect();
618
619                if owner_filters.is_empty() {
620                    let mut filters = c.filters().to_vec();
621                    filters.push(owner_filter.clone());
622                    return Some(ScopeConstraint::new(filters));
623                }
624
625                // Intersection semantics: ALL owner_id predicates must contain
626                // the supplied owner_id, otherwise the constraint is dropped.
627                let all_match = owner_filters
628                    .iter()
629                    .all(|f| f.values().iter().any(|v| v.as_uuid() == Some(owner_id)));
630                if !all_match {
631                    return None;
632                }
633
634                // Fast path: single Eq already matches → constraint unchanged.
635                if owner_filters.len() == 1 && matches!(owner_filters[0], ScopeFilter::Eq(_)) {
636                    return Some(c.clone());
637                }
638
639                // Replace all owner_id filters with a single Eq.
640                let mut filters: Vec<ScopeFilter> = c
641                    .filters()
642                    .iter()
643                    .filter(|f| f.property() != pep_properties::OWNER_ID)
644                    .cloned()
645                    .collect();
646                filters.push(owner_filter.clone());
647                Some(ScopeConstraint::new(filters))
648            })
649            .collect();
650
651        Self::from_constraints(constraints)
652    }
653
654    /// Internal helper: build a new scope keeping only filters whose property
655    /// is in the given whitelist.
656    fn retain_properties(&self, properties: &[&str]) -> Self {
657        if self.unconstrained {
658            return Self::deny_all();
659        }
660
661        let constraints = self
662            .constraints
663            .iter()
664            .filter_map(|c| {
665                let kept: Vec<ScopeFilter> = c
666                    .filters()
667                    .iter()
668                    .filter(|f| properties.contains(&f.property()))
669                    .cloned()
670                    .collect();
671
672                if kept.is_empty() {
673                    None
674                } else {
675                    Some(ScopeConstraint::new(kept))
676                }
677            })
678            .collect();
679
680        Self::from_constraints(constraints)
681    }
682}
683
684#[cfg(test)]
685#[cfg_attr(coverage_nightly, coverage(off))]
686mod tests {
687    use super::*;
688    use uuid::Uuid;
689
690    const T1: &str = "11111111-1111-1111-1111-111111111111";
691    const T2: &str = "22222222-2222-2222-2222-222222222222";
692
693    fn uid(s: &str) -> Uuid {
694        Uuid::parse_str(s).unwrap()
695    }
696
697    // --- ScopeFilter::Eq ---
698
699    #[test]
700    fn scope_filter_eq_constructor() {
701        let f = ScopeFilter::eq(pep_properties::OWNER_TENANT_ID, uid(T1));
702        assert_eq!(f.property(), pep_properties::OWNER_TENANT_ID);
703        assert!(matches!(f, ScopeFilter::Eq(_)));
704        assert!(f.values().contains(&ScopeValue::Uuid(uid(T1))));
705    }
706
707    #[test]
708    fn all_values_for_works_with_eq() {
709        let scope = AccessScope::single(ScopeConstraint::new(vec![ScopeFilter::eq(
710            pep_properties::OWNER_TENANT_ID,
711            uid(T1),
712        )]));
713        assert_eq!(
714            scope.all_uuid_values_for(pep_properties::OWNER_TENANT_ID),
715            &[uid(T1)]
716        );
717    }
718
719    #[test]
720    fn all_values_for_works_with_mixed_eq_and_in() {
721        let scope = AccessScope::from_constraints(vec![
722            ScopeConstraint::new(vec![ScopeFilter::eq(
723                pep_properties::OWNER_TENANT_ID,
724                uid(T1),
725            )]),
726            ScopeConstraint::new(vec![ScopeFilter::in_uuids(
727                pep_properties::OWNER_TENANT_ID,
728                vec![uid(T2)],
729            )]),
730        ]);
731        let values = scope.all_uuid_values_for(pep_properties::OWNER_TENANT_ID);
732        assert_eq!(values, &[uid(T1), uid(T2)]);
733    }
734
735    #[test]
736    fn contains_value_works_with_eq() {
737        let scope = AccessScope::single(ScopeConstraint::new(vec![ScopeFilter::eq(
738            pep_properties::OWNER_TENANT_ID,
739            uid(T1),
740        )]));
741        assert!(scope.contains_uuid(pep_properties::OWNER_TENANT_ID, uid(T1)));
742        assert!(!scope.contains_uuid(pep_properties::OWNER_TENANT_ID, uid(T2)));
743    }
744
745    // --- tenant_only ---
746
747    #[test]
748    fn tenant_only_strips_owner_id() {
749        let scope = AccessScope::single(ScopeConstraint::new(vec![
750            ScopeFilter::eq(pep_properties::OWNER_TENANT_ID, uid(T1)),
751            ScopeFilter::eq(pep_properties::OWNER_ID, uid(T2)),
752        ]));
753
754        let tenant_scope = scope.tenant_only();
755        assert!(tenant_scope.contains_uuid(pep_properties::OWNER_TENANT_ID, uid(T1)));
756        assert!(!tenant_scope.has_property(pep_properties::OWNER_ID));
757    }
758
759    #[test]
760    fn tenant_only_unconstrained_becomes_deny_all() {
761        let scope = AccessScope::allow_all();
762        let tenant_scope = scope.tenant_only();
763        assert!(tenant_scope.is_deny_all());
764    }
765
766    #[test]
767    fn tenant_only_deny_all_when_no_tenant_filters() {
768        let scope = AccessScope::single(ScopeConstraint::new(vec![ScopeFilter::eq(
769            pep_properties::OWNER_ID,
770            uid(T1),
771        )]));
772
773        let tenant_scope = scope.tenant_only();
774        assert!(tenant_scope.is_deny_all());
775    }
776
777    #[test]
778    fn tenant_only_on_deny_all_stays_deny_all() {
779        let scope = AccessScope::deny_all();
780        let tenant_scope = scope.tenant_only();
781        assert!(tenant_scope.is_deny_all());
782    }
783
784    // --- tenant_and_owner ---
785
786    #[test]
787    fn tenant_and_owner_keeps_both_properties() {
788        let scope = AccessScope::single(ScopeConstraint::new(vec![
789            ScopeFilter::eq(pep_properties::OWNER_TENANT_ID, uid(T1)),
790            ScopeFilter::eq(pep_properties::OWNER_ID, uid(T2)),
791            ScopeFilter::eq(pep_properties::RESOURCE_ID, uid(T1)),
792        ]));
793
794        let narrowed = scope.tenant_and_owner();
795        assert!(narrowed.contains_uuid(pep_properties::OWNER_TENANT_ID, uid(T1)));
796        assert!(narrowed.contains_uuid(pep_properties::OWNER_ID, uid(T2)));
797        assert!(!narrowed.has_property(pep_properties::RESOURCE_ID));
798    }
799
800    #[test]
801    fn tenant_and_owner_unconstrained_becomes_deny_all() {
802        let scope = AccessScope::allow_all();
803        assert!(scope.tenant_and_owner().is_deny_all());
804    }
805
806    #[test]
807    fn tenant_and_owner_deny_all_when_no_matching_filters() {
808        let scope = AccessScope::single(ScopeConstraint::new(vec![ScopeFilter::eq(
809            pep_properties::RESOURCE_ID,
810            uid(T1),
811        )]));
812        assert!(scope.tenant_and_owner().is_deny_all());
813    }
814
815    // --- ensure_owner ---
816
817    #[test]
818    fn ensure_owner_adds_owner_when_missing() {
819        let scope = AccessScope::for_tenant(uid(T1));
820        let owner_id = uid(T2);
821
822        let scoped = scope.ensure_owner(owner_id);
823        assert!(scoped.contains_uuid(pep_properties::OWNER_TENANT_ID, uid(T1)));
824        assert!(scoped.contains_uuid(pep_properties::OWNER_ID, owner_id));
825    }
826
827    #[test]
828    fn ensure_owner_keeps_existing_owner() {
829        let existing_owner = uid(T2);
830        let scope = AccessScope::single(ScopeConstraint::new(vec![
831            ScopeFilter::eq(pep_properties::OWNER_TENANT_ID, uid(T1)),
832            ScopeFilter::eq(pep_properties::OWNER_ID, existing_owner),
833        ]));
834
835        let scoped = scope.ensure_owner(existing_owner);
836        assert_eq!(
837            scoped.all_uuid_values_for(pep_properties::OWNER_ID),
838            &[existing_owner]
839        );
840    }
841
842    #[test]
843    fn ensure_owner_on_unconstrained_creates_owner_scope() {
844        let scope = AccessScope::allow_all();
845        let owner_id = uid(T1);
846
847        let scoped = scope.ensure_owner(owner_id);
848        assert!(!scoped.is_unconstrained());
849        assert!(scoped.contains_uuid(pep_properties::OWNER_ID, owner_id));
850    }
851
852    #[test]
853    fn ensure_owner_on_deny_all_stays_deny_all() {
854        let scope = AccessScope::deny_all();
855        let scoped = scope.ensure_owner(uid(T1));
856        assert!(scoped.is_deny_all());
857    }
858
859    #[test]
860    fn ensure_owner_narrows_existing_owner_to_subject() {
861        let user_a = uid(T1);
862        let user_b = uid(T2);
863        let scope = AccessScope::single(ScopeConstraint::new(vec![
864            ScopeFilter::eq(pep_properties::OWNER_TENANT_ID, uid(T1)),
865            ScopeFilter::in_uuids(pep_properties::OWNER_ID, vec![user_a, user_b]),
866        ]));
867
868        let scoped = scope.ensure_owner(user_a);
869        assert_eq!(
870            scoped.all_uuid_values_for(pep_properties::OWNER_ID),
871            &[user_a],
872            "Must narrow to exactly the subject's owner_id"
873        );
874        assert!(scoped.contains_uuid(pep_properties::OWNER_TENANT_ID, uid(T1)));
875    }
876
877    #[test]
878    fn ensure_owner_drops_constraint_when_subject_not_in_pdp() {
879        let user_x = uid(T1);
880        let user_y = uid(T2);
881        let scope = AccessScope::single(ScopeConstraint::new(vec![
882            ScopeFilter::eq(pep_properties::OWNER_TENANT_ID, uid(T1)),
883            ScopeFilter::eq(pep_properties::OWNER_ID, user_x),
884        ]));
885
886        let scoped = scope.ensure_owner(user_y);
887        assert!(
888            scoped.is_deny_all(),
889            "Must be deny-all when subject not in PDP's owner set"
890        );
891    }
892
893    #[test]
894    fn ensure_owner_checks_all_owner_filters_in_constraint() {
895        let alice = uid(T1);
896        let bob = uid(T2);
897        // Contrived: two owner_id filters in one constraint.
898        // alice is in the first but not the second → must be dropped.
899        let scope = AccessScope::single(ScopeConstraint::new(vec![
900            ScopeFilter::in_uuids(pep_properties::OWNER_ID, vec![alice, bob]),
901            ScopeFilter::in_uuids(pep_properties::OWNER_ID, vec![bob]),
902        ]));
903
904        let scoped = scope.ensure_owner(alice);
905        assert!(
906            scoped.is_deny_all(),
907            "Must deny when subject is missing from any owner_id filter"
908        );
909
910        // bob is in both → should pass and narrow to Eq.
911        let scoped = scope.ensure_owner(bob);
912        assert!(!scoped.is_deny_all());
913        assert_eq!(
914            scoped.all_uuid_values_for(pep_properties::OWNER_ID),
915            &[bob],
916            "Must narrow to single Eq for the matching owner"
917        );
918    }
919
920    #[test]
921    fn ensure_owner_multi_constraint_keeps_only_matching() {
922        let alice = uid(T1);
923        let bob = uid(T2);
924        let tenant = uid(T1);
925
926        // Constraint 1: tenant + alice → matches alice
927        let c1 = ScopeConstraint::new(vec![
928            ScopeFilter::eq(pep_properties::OWNER_TENANT_ID, tenant),
929            ScopeFilter::eq(pep_properties::OWNER_ID, alice),
930        ]);
931        // Constraint 2: tenant + bob → does NOT match alice
932        let c2 = ScopeConstraint::new(vec![
933            ScopeFilter::eq(pep_properties::OWNER_TENANT_ID, tenant),
934            ScopeFilter::eq(pep_properties::OWNER_ID, bob),
935        ]);
936
937        let scope = AccessScope::from_constraints(vec![c1, c2]);
938        let scoped = scope.ensure_owner(alice);
939
940        assert!(
941            !scoped.is_deny_all(),
942            "Must not be deny-all - one constraint matches"
943        );
944        assert_eq!(
945            scoped.all_uuid_values_for(pep_properties::OWNER_ID),
946            &[alice],
947            "Must keep only the constraint matching alice"
948        );
949        assert!(
950            scoped.contains_uuid(pep_properties::OWNER_TENANT_ID, tenant),
951            "Tenant filter must be preserved"
952        );
953    }
954
955    #[test]
956    fn contains_uuid_matches_string_variant() {
957        let scope = AccessScope::single(ScopeConstraint::new(vec![ScopeFilter::eq(
958            pep_properties::OWNER_TENANT_ID,
959            ScopeValue::String(T1.to_owned()),
960        )]));
961        assert!(scope.contains_uuid(pep_properties::OWNER_TENANT_ID, uid(T1)));
962        assert!(!scope.contains_uuid(pep_properties::OWNER_TENANT_ID, uid(T2)));
963    }
964
965    #[test]
966    fn contains_uuid_does_not_match_invalid_string() {
967        let scope = AccessScope::single(ScopeConstraint::new(vec![ScopeFilter::eq(
968            pep_properties::OWNER_TENANT_ID,
969            ScopeValue::String("not-a-uuid".to_owned()),
970        )]));
971        assert!(!scope.contains_uuid(pep_properties::OWNER_TENANT_ID, uid(T1)));
972    }
973}
modkit_security/access_scope.rs

modkit_security/
access_scope.rs
