runx-core 0.6.19

Pure Rust parity kernel for runx state-machine and policy decisions.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101

use runx_contracts::JsonValue;

use crate::policy::{
    LocalAdmissionGrant, LocalScopeAdmissionOptions, ScopeAdmission, ScopeAdmissionStatus,
    credential_grant::{credential_grant_requirement, find_matching_grant},
    scope::unique_strings,
};

use super::util::{non_empty_option, non_empty_vec};

#[must_use]
pub fn build_local_scope_admission(
    auth: Option<&JsonValue>,
    grants: &[LocalAdmissionGrant],
    options: &LocalScopeAdmissionOptions,
) -> ScopeAdmission {
    let requirement = match credential_grant_requirement(auth) {
        Ok(Some(requirement)) => requirement,
        Ok(None) => {
            return scope_admission_allow(
                Vec::new(),
                Vec::new(),
                None,
                "no connected auth requested",
            );
        }
        Err(error) => {
            return scope_admission_deny(
                Vec::new(),
                Vec::new(),
                vec![error.message().to_owned()],
                "invalid connected auth request",
            );
        }
    };

    let requested_scopes = unique_strings(&requirement.scopes);
    if options.denied_before_grant_resolution.unwrap_or(false) {
        return scope_admission_deny(
            requested_scopes,
            Vec::new(),
            vec!["structural policy denied before connected auth grant resolution".to_owned()],
            "structural policy denied before grant resolution",
        );
    }

    match find_matching_grant(
        &requirement,
        grants,
        options.connected_auth_checked_at.as_deref(),
        options.wildcard_scopes_trusted,
    ) {
        Some(grant) => scope_admission_allow(
            requested_scopes,
            unique_strings(&grant.scopes),
            Some(grant.grant_id.clone()),
            "matching active grant admitted",
        ),
        None => scope_admission_deny(
            requested_scopes,
            Vec::new(),
            vec![format!(
                "connected auth grant required for provider '{}'",
                requirement.provider
            )],
            "no matching active grant resolved",
        ),
    }
}

fn scope_admission_allow(
    requested_scopes: Vec<String>,
    granted_scopes: Vec<String>,
    grant_id: Option<String>,
    summary: &str,
) -> ScopeAdmission {
    ScopeAdmission {
        status: ScopeAdmissionStatus::Allow,
        requested_scopes: non_empty_vec(requested_scopes),
        granted_scopes: non_empty_vec(granted_scopes),
        grant_id: non_empty_option(grant_id),
        reasons: None,
        decision_summary: Some(summary.to_owned()),
    }
}

fn scope_admission_deny(
    requested_scopes: Vec<String>,
    granted_scopes: Vec<String>,
    reasons: Vec<String>,
    summary: &str,
) -> ScopeAdmission {
    ScopeAdmission {
        status: ScopeAdmissionStatus::Deny,
        requested_scopes: non_empty_vec(requested_scopes),
        granted_scopes: non_empty_vec(granted_scopes),
        grant_id: None,
        reasons: Some(non_empty_vec(reasons)),
        decision_summary: Some(summary.to_owned()),
    }
}