scratchstack-aspen 0.3.1

AWS IAM policy language (Aspen) parser and internal representation
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117

use {
    super::variant::Variant,
    crate::{serutil::StringLikeList, AspenError, Context, PolicyVersion},
    scratchstack_aws_principal::SessionValue,
    std::str::FromStr,
};

/// Numeric operation names.
pub(super) const NUMERIC_DISPLAY_NAMES: [&str; 12] = [
    "NumericEquals",
    "NumericEqualsIfExists",
    "NumericNotEquals",
    "NumericNotEqualsIfExists",
    "NumericLessThan",
    "NumericLessThanIfExists",
    "NumericGreaterThanEquals",
    "NumericGreaterThanEqualsIfExists",
    "NumericLessThanEquals",
    "NumericLessThanEqualsIfExists",
    "NumericGreaterThan",
    "NumericGreaterThanIfExists",
];

#[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
#[repr(u8)]
pub enum NumericCmp {
    Equals = 0,
    LessThan = 4,
    LessThanEquals = 8,
}

impl NumericCmp {
    pub(super) fn display_name(&self, variant: &Variant) -> &'static str {
        NUMERIC_DISPLAY_NAMES[*self as usize | variant.as_usize()]
    }
}

pub(super) fn numeric_match(
    context: &Context,
    pv: PolicyVersion,
    allowed: &StringLikeList<String>,
    value: &SessionValue,
    cmp: NumericCmp,
    variant: Variant,
) -> Result<bool, AspenError> {
    match value {
        SessionValue::Null => Ok(variant.if_exists()),
        SessionValue::Integer(value) => {
            let fn_op = match (cmp, variant.negated()) {
                (NumericCmp::Equals, false) => |a: i64, b: i64| a == b,
                (NumericCmp::Equals, true) => |a: i64, b: i64| a != b,
                (NumericCmp::LessThan, false) => |a: i64, b: i64| a < b,
                (NumericCmp::LessThan, true) => |a: i64, b: i64| a >= b,
                (NumericCmp::LessThanEquals, false) => |a: i64, b: i64| a <= b,
                (NumericCmp::LessThanEquals, true) => |a: i64, b: i64| a > b,
            };

            for el in allowed.iter() {
                let el = match pv {
                    PolicyVersion::None | PolicyVersion::V2008_10_17 => el.clone(),
                    PolicyVersion::V2012_10_17 => context.subst_vars_plain(el)?,
                };

                if let Ok(parsed) = i64::from_str(&el) {
                    if fn_op(*value, parsed) {
                        return Ok(true);
                    }
                }
            }

            Ok(false)
        }
        SessionValue::String(value) => {
            let value = match i64::from_str(value) {
                Ok(value) => value,
                Err(_) => return Ok(false),
            };

            let fn_op = match (cmp, variant.negated()) {
                (NumericCmp::Equals, false) => |a: i64, b: i64| a == b,
                (NumericCmp::Equals, true) => |a: i64, b: i64| a != b,
                (NumericCmp::LessThan, false) => |a: i64, b: i64| a < b,
                (NumericCmp::LessThan, true) => |a: i64, b: i64| a >= b,
                (NumericCmp::LessThanEquals, false) => |a: i64, b: i64| a <= b,
                (NumericCmp::LessThanEquals, true) => |a: i64, b: i64| a > b,
            };

            for el in allowed.iter() {
                let el = match pv {
                    PolicyVersion::None | PolicyVersion::V2008_10_17 => el.clone(),
                    PolicyVersion::V2012_10_17 => context.subst_vars_plain(el)?,
                };

                if let Ok(parsed) = i64::from_str(&el) {
                    if fn_op(value, parsed) {
                        return Ok(true);
                    }
                }
            }

            Ok(false)
        }
        _ => Ok(false),
    }
}

#[cfg(test)]
mod tests {
    use {super::NumericCmp, pretty_assertions::assert_eq};

    #[test_log::test]
    fn test_clone() {
        assert_eq!(NumericCmp::Equals.clone(), NumericCmp::Equals);
        assert_eq!(NumericCmp::LessThan.clone(), NumericCmp::LessThan);
        assert_eq!(NumericCmp::LessThanEquals.clone(), NumericCmp::LessThanEquals);
    }
}