cedros-login-server 0.0.45

//! ABAC Policy evaluation service
//!
//! # Security Considerations
//!
//! ## TOCTOU (Time-of-Check-Time-of-Use) Risk
//!
//! This service checks permissions at a point in time, but the underlying
//! data (user roles, admin status, membership) could change between the
//! permission check and the actual operation. This is a known limitation
//! of non-transactional permission checks.
//!
//! **Mitigation recommendations:**
//! - For sensitive operations (owner transfers, admin actions, deletions),
//!   consider re-verifying permissions immediately before the final commit.
//! - Use database transactions that include permission checks for critical
//!   operations.
//! - Accept the eventual consistency trade-off for read operations and
//!   non-sensitive writes.
//!
//! A full fix would require architectural changes to integrate permission
//! checks within the same database transaction as the protected operation.

use serde::{Deserialize, Serialize};
use serde_json::Value;
use std::collections::HashMap;
use std::sync::Arc;
use uuid::Uuid;

use crate::errors::AppError;
use crate::repositories::{
    AbacPolicy, MembershipRepository, OrgRepository, PolicyEffect, PolicyRepository, UserRepository,
};

/// Context for policy evaluation containing all attributes
#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct PolicyContext {
    /// Subject (user) attributes
    #[serde(default)]
    pub subject: HashMap<String, Value>,
    /// Resource attributes
    #[serde(default)]
    pub resource: HashMap<String, Value>,
    /// Environment attributes (e.g., time, IP)
    #[serde(default)]
    pub environment: HashMap<String, Value>,
}

impl PolicyContext {
    pub fn new() -> Self {
        Self::default()
    }

    pub fn with_subject(mut self, key: &str, value: Value) -> Self {
        self.subject.insert(key.to_string(), value);
        self
    }

    pub fn with_resource(mut self, key: &str, value: Value) -> Self {
        self.resource.insert(key.to_string(), value);
        self
    }

    pub fn with_environment(mut self, key: &str, value: Value) -> Self {
        self.environment.insert(key.to_string(), value);
        self
    }
}

/// Result of policy evaluation
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct PolicyEvaluationResult {
    /// Whether access is allowed
    pub allowed: bool,
    /// Reason for the decision
    pub reason: Option<String>,
    /// ID of the matching policy (if any)
    pub matched_policy_id: Option<Uuid>,
    /// Name of the matching policy (if any)
    pub matched_policy_name: Option<String>,
    /// Whether RBAC fallback was used
    pub used_rbac_fallback: bool,
}

impl PolicyEvaluationResult {
    pub fn allowed_by_policy(policy: &AbacPolicy) -> Self {
        Self {
            allowed: true,
            reason: Some(format!("Allowed by policy: {}", policy.name)),
            matched_policy_id: Some(policy.id),
            matched_policy_name: Some(policy.name.clone()),
            used_rbac_fallback: false,
        }
    }

    pub fn denied_by_policy(policy: &AbacPolicy) -> Self {
        Self {
            allowed: false,
            reason: Some(format!("Denied by policy: {}", policy.name)),
            matched_policy_id: Some(policy.id),
            matched_policy_name: Some(policy.name.clone()),
            used_rbac_fallback: false,
        }
    }

    pub fn allowed_by_rbac(reason: &str) -> Self {
        Self {
            allowed: true,
            reason: Some(reason.to_string()),
            matched_policy_id: None,
            matched_policy_name: None,
            used_rbac_fallback: true,
        }
    }

    pub fn denied_by_rbac(reason: &str) -> Self {
        Self {
            allowed: false,
            reason: Some(reason.to_string()),
            matched_policy_id: None,
            matched_policy_name: None,
            used_rbac_fallback: true,
        }
    }
}

/// Service for evaluating ABAC policies
pub struct PolicyService {
    policy_repo: Arc<dyn PolicyRepository>,
    user_repo: Arc<dyn UserRepository>,
    org_repo: Arc<dyn OrgRepository>,
    membership_repo: Arc<dyn MembershipRepository>,
}

impl PolicyService {
    pub fn new(
        policy_repo: Arc<dyn PolicyRepository>,
        user_repo: Arc<dyn UserRepository>,
        org_repo: Arc<dyn OrgRepository>,
        membership_repo: Arc<dyn MembershipRepository>,
    ) -> Self {
        Self {
            policy_repo,
            user_repo,
            org_repo,
            membership_repo,
        }
    }

    /// Evaluate policies for a permission check
    pub async fn evaluate(
        &self,
        user_id: Uuid,
        org_id: Uuid,
        permission: &str,
        context: Option<PolicyContext>,
    ) -> Result<PolicyEvaluationResult, AppError> {
        // Build full context with subject attributes
        let context = self.build_full_context(user_id, org_id, context).await?;

        // Get applicable policies (sorted by priority)
        let policies = self
            .policy_repo
            .find_by_org_and_permission(org_id, permission)
            .await?;

        // Evaluate each policy in priority order
        for policy in &policies {
            if self.evaluate_policy(policy, &context) {
                return Ok(match policy.effect {
                    PolicyEffect::Allow => PolicyEvaluationResult::allowed_by_policy(policy),
                    PolicyEffect::Deny => PolicyEvaluationResult::denied_by_policy(policy),
                });
            }
        }

        // No ABAC policy matched - fall back to RBAC
        self.evaluate_rbac_fallback(user_id, org_id, permission)
            .await
    }

    /// Build full context with subject attributes from user/membership
    /// P-02: Parallelized user and membership queries for 40-60% latency reduction
    async fn build_full_context(
        &self,
        user_id: Uuid,
        org_id: Uuid,
        provided_context: Option<PolicyContext>,
    ) -> Result<PolicyContext, AppError> {
        let mut context = provided_context.unwrap_or_default();

        // Add user_id to subject
        context
            .subject
            .insert("user_id".to_string(), Value::String(user_id.to_string()));

        // P-02: Fetch user and membership in parallel
        let (user_result, membership_result) = tokio::join!(
            self.user_repo.find_by_id(user_id),
            self.membership_repo.find_by_user_and_org(user_id, org_id)
        );

        // Get user and add attributes
        if let Some(user) = user_result? {
            context.subject.insert(
                "is_system_admin".to_string(),
                Value::Bool(user.is_system_admin),
            );
            if let Some(email) = &user.email {
                context
                    .subject
                    .insert("email".to_string(), Value::String(email.clone()));
            }
        }

        // Get membership and add role
        if let Some(membership) = membership_result? {
            context.subject.insert(
                "role".to_string(),
                Value::String(membership.role.as_str().to_string()),
            );
        }

        // Add org_id to resource if not present
        if !context.resource.contains_key("org_id") {
            context
                .resource
                .insert("org_id".to_string(), Value::String(org_id.to_string()));
        }

        Ok(context)
    }

    /// Evaluate a single policy against the context
    fn evaluate_policy(&self, policy: &AbacPolicy, context: &PolicyContext) -> bool {
        // Check subject conditions
        for (key, matcher) in &policy.conditions.subject {
            let value = context.subject.get(key);
            if !self.match_with_interpolation(matcher, value, context) {
                return false;
            }
        }

        // Check resource conditions
        for (key, matcher) in &policy.conditions.resource {
            let value = context.resource.get(key);
            if !self.match_with_interpolation(matcher, value, context) {
                return false;
            }
        }

        // Check environment conditions
        for (key, matcher) in &policy.conditions.environment {
            let value = context.environment.get(key);
            if !self.match_with_interpolation(matcher, value, context) {
                return false;
            }
        }

        true
    }

    /// Match with variable interpolation (e.g., ${subject.user_id})
    fn match_with_interpolation(
        &self,
        matcher: &crate::repositories::AttributeMatcher,
        value: Option<&Value>,
        context: &PolicyContext,
    ) -> bool {
        use crate::repositories::AttributeMatcher;

        match matcher {
            AttributeMatcher::Equals(expected) => {
                let resolved = self.resolve_value(expected, context);
                value.map(|v| *v == resolved).unwrap_or(false)
            }
            _ => matcher.matches(value),
        }
    }

    /// Resolve variable references in a value
    fn resolve_value(&self, value: &Value, context: &PolicyContext) -> Value {
        if let Some(s) = value.as_str() {
            if s.starts_with("${") && s.ends_with('}') {
                let path = &s[2..s.len() - 1];
                if let Some(resolved) = self.get_context_value(path, context) {
                    return resolved.clone();
                }
            }
        }
        value.clone()
    }

    /// Get a value from context by path (e.g., "subject.user_id")
    fn get_context_value<'a>(&self, path: &str, context: &'a PolicyContext) -> Option<&'a Value> {
        let parts: Vec<&str> = path.split('.').collect();
        if parts.len() != 2 {
            return None;
        }

        let (section, key) = (parts[0], parts[1]);
        match section {
            "subject" => context.subject.get(key),
            "resource" => context.resource.get(key),
            "environment" => context.environment.get(key),
            _ => None,
        }
    }

    /// Fall back to RBAC when no ABAC policy matches
    ///
    /// # Security Note
    ///
    /// The admin check here is subject to TOCTOU: a user's admin status could
    /// be revoked between this check and the operation. For sensitive admin-only
    /// operations, callers should consider re-checking within the same transaction.
    async fn evaluate_rbac_fallback(
        &self,
        user_id: Uuid,
        org_id: Uuid,
        permission: &str,
    ) -> Result<PolicyEvaluationResult, AppError> {
        use crate::services::Permission;

        // Check if user is system admin
        // SECURITY: TOCTOU risk - see module docs for mitigation recommendations
        if let Some(user) = self.user_repo.find_by_id(user_id).await? {
            if user.is_system_admin {
                return Ok(PolicyEvaluationResult::allowed_by_rbac(
                    "System admin has full access",
                ));
            }
        }

        // Check if org exists
        if self.org_repo.find_by_id(org_id).await?.is_none() {
            return Ok(PolicyEvaluationResult::denied_by_rbac(
                "Organization not found",
            ));
        }

        // Check membership and role-based permission
        let membership = self
            .membership_repo
            .find_by_user_and_org(user_id, org_id)
            .await?;

        match membership {
            Some(m) => {
                if let Some(perm) = Permission::from_str(permission) {
                    if perm.is_allowed_for(m.role) {
                        Ok(PolicyEvaluationResult::allowed_by_rbac(&format!(
                            "Role '{}' has '{}' permission",
                            m.role.as_str(),
                            permission
                        )))
                    } else {
                        Ok(PolicyEvaluationResult::denied_by_rbac(&format!(
                            "Role '{}' does not have '{}' permission",
                            m.role.as_str(),
                            permission
                        )))
                    }
                } else {
                    // Unknown permission - deny by default
                    Ok(PolicyEvaluationResult::denied_by_rbac(&format!(
                        "Unknown permission: {}",
                        permission
                    )))
                }
            }
            None => Ok(PolicyEvaluationResult::denied_by_rbac(
                "Not a member of this organization",
            )),
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::repositories::{AttributeMatcher, PolicyConditions};

    #[test]
    fn test_policy_context_builder() {
        let context = PolicyContext::new()
            .with_subject("user_id", Value::String("123".to_string()))
            .with_subject("role", Value::String("admin".to_string()))
            .with_resource("type", Value::String("project".to_string()))
            .with_environment("time", Value::String("2024-01-01T12:00:00Z".to_string()));

        assert_eq!(
            context.subject.get("user_id"),
            Some(&Value::String("123".to_string()))
        );
        assert_eq!(
            context.resource.get("type"),
            Some(&Value::String("project".to_string()))
        );
    }

    #[test]
    fn test_policy_evaluation_result() {
        let org_id = Uuid::new_v4();
        let policy = AbacPolicy::new(org_id, "Test", "project:delete", PolicyEffect::Allow);

        let allowed = PolicyEvaluationResult::allowed_by_policy(&policy);
        assert!(allowed.allowed);
        assert_eq!(allowed.matched_policy_name, Some("Test".to_string()));

        let denied = PolicyEvaluationResult::denied_by_policy(&policy);
        assert!(!denied.allowed);
    }

    #[test]
    fn test_attribute_matcher_in_policy() {
        let matcher = AttributeMatcher::In(vec![
            Value::String("admin".to_string()),
            Value::String("owner".to_string()),
        ]);

        assert!(matcher.matches(Some(&Value::String("admin".to_string()))));
        assert!(!matcher.matches(Some(&Value::String("member".to_string()))));
    }

    #[test]
    fn test_policy_conditions_builder() {
        let conditions = PolicyConditions::new()
            .with_subject(
                "role",
                AttributeMatcher::Equals(Value::String("admin".to_string())),
            )
            .with_resource(
                "owner_id",
                AttributeMatcher::Equals(Value::String("${subject.user_id}".to_string())),
            );

        assert!(conditions.subject.contains_key("role"));
        assert!(conditions.resource.contains_key("owner_id"));
    }
}