Enum ContextExpr

Source

pub enum ContextExpr {
    And(Box<ContextExpr>, Box<ContextExpr>),
    Or(Box<ContextExpr>, Box<ContextExpr>),
    Not(Box<ContextExpr>),
    HasAttribute(String),
    Compare {
        key: String,
        op: CompareOp,
        value: String,
    },
    True,
    False,
}

Expand description

Context expression for ABAC evaluation

This enum represents a boolean expression tree that can be evaluated against a context (attribute map) to determine if conditions are met.

§Design Rationale

Recursive Structure: Allows complex nested conditions
Type Safety: Rust’s type system prevents malformed expressions
Deterministic: No floating point, no random operations
Serializable: Can be stored in policy files (YAML/JSON)

§Example

extern crate alloc;
use core_policy::context_expr::{ContextExpr, CompareOp};
use alloc::collections::BTreeMap;
use alloc::string::ToString;

let expr = ContextExpr::And(
    Box::new(ContextExpr::Compare {
        key: "role".into(),
        op: CompareOp::Equal,
        value: "admin".into(),
    }),
    Box::new(ContextExpr::Compare {
        key: "department".into(),
        op: CompareOp::Equal,
        value: "IT".into(),
    }),
);

let mut context = BTreeMap::new();
context.insert("role".to_string(), "admin".to_string());
context.insert("department".to_string(), "IT".to_string());

assert!(expr.evaluate(&context, 0).unwrap());

Variants§

§

And(Box<ContextExpr>, Box<ContextExpr>)

Logical AND (both operands must be true)

§

Or(Box<ContextExpr>, Box<ContextExpr>)

Logical OR (at least one operand must be true)

§

Not(Box<ContextExpr>)

Logical NOT (negates the operand)

§

HasAttribute(String)

Check if an attribute exists in the context

§

Compare

Compare an attribute value with a constant

Fields

§key: String

Attribute key to compare

§op: CompareOp

Comparison operator

§value: String

Value to compare against (as string)

§

True

Always true (useful for testing and default cases)

§

False

Always false

Implementations§

Source §

impl ContextExpr

Source

pub fn evaluate( &self, context: &BTreeMap<String, String>, depth: usize, ) -> Result<bool>

Evaluate this expression against a context

§Arguments

context - Attribute map to evaluate against
depth - Current recursion depth (prevents stack overflow)

§Returns

Ok(true) - Expression evaluates to true
Ok(false) - Expression evaluates to false
Err(PolicyError::ExpressionTooDeep) - Recursion limit exceeded

§Example

extern crate alloc;
use core_policy::context_expr::{ContextExpr, CompareOp};
use alloc::collections::BTreeMap;
use alloc::string::ToString;

let expr = ContextExpr::Compare {
    key: "role".into(),
    op: CompareOp::Equal,
    value: "admin".into(),
};

let mut context = BTreeMap::new();
context.insert("role".to_string(), "admin".to_string());

assert!(expr.evaluate(&context, 0).unwrap());

Source

pub fn parse(input: &str) -> Result<Self>

Parse a context expression from a string

§Grammar (simplified)

expr       ::= or_expr
or_expr    ::= and_expr (OR and_expr)*
and_expr   ::= not_expr (AND not_expr)*
not_expr   ::= NOT primary | primary
primary    ::= HAS key | key op value | (expr) | TRUE | FALSE
op         ::= == | != | < | <= | > | >=

§Examples

use core_policy::context_expr::ContextExpr;

let expr = ContextExpr::parse("role == \"admin\"").unwrap();
let expr = ContextExpr::parse("role == \"admin\" AND department == \"IT\"").unwrap();
let expr = ContextExpr::parse("(role == \"admin\" OR role == \"moderator\") AND active == \"true\"").unwrap();
let expr = ContextExpr::parse("NOT (status == \"banned\")").unwrap();
let expr = ContextExpr::parse("HAS role").unwrap();