zift 0.2.2

Scan codebases for embedded authorization logic and generate Policy as Code (Rego/OPA today)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

[rule]
id = "java-authenticated-check"
languages = ["java"]
category = "middleware"
confidence = "medium"
description = "Authentication status check (isAuthenticated, isAnonymous, etc.)"
query = """
(method_invocation
  name: (identifier) @method_name
  arguments: (argument_list)
) @match
"""

[rule.predicates.method_name]
match = "^(isAuthenticated|isAnonymous|isFullyAuthenticated|isRememberMe)$"

[[rule.tests]]
input = """
public class Service {
    public void check() {
        if (authentication.isAuthenticated()) { allow(); }
    }
}
"""
expect_match = true

[[rule.tests]]
input = """
public class Service {
    public void check() {
        if (request.isSecure()) { allow(); }
    }
}
"""
expect_match = false