Refactor: Enhance Statement.name (#56)

Ahoo-Wang · Jan 6, 2023 · 68b407d · 68b407d
1 parent bece707
commit 68b407d
Show file tree

Hide file tree

Showing 20 changed files with 350 additions and 289 deletions.
diff --git a/README.md b/README.md
@@ -49,95 +49,100 @@ RBAC-based And Policy-based Multi-Tenant Reactive Security Framework.
 
 ```json
 {
-  "id": "2",
-  "name": "auth",
-  "category": "auth",
-  "description": "",
+  "id": "id",
+  "name": "name",
+  "category": "category",
+  "description": "description",
   "type": "global",
-  "tenantId": "1",
+  "tenantId": "tenantId",
   "statements": [
     {
+      "name": "Anonymous",
       "effect": "allow",
       "actions": [
         {
-          "type": "all"
+          "type": "path",
+          "pattern": "/auth/register"
         },
         {
-          "type": "none"
-        },
+          "type": "path",
+          "pattern": "/auth/login"
+        }
+      ]
+    },
+    {
+      "name": "UserScope",
+      "effect": "allow",
+      "actions": [
         {
           "type": "path",
-          "methods": [
-            "GET",
-            "POST",
-            "PUT",
-            "DELETE"
-          ],
-          "pattern": "/user/{userId}/*"
+          "pattern": "/user/#{principal.id}/*"
         }
       ],
       "conditions": [
         {
           "type": "authenticated"
-        },
+        }
+      ]
+    },
+    {
+      "name": "Developer",
+      "effect": "allow",
+      "actions": [
+        {
+          "type": "all"
+        }
+      ],
+      "conditions": [
         {
           "type": "in",
           "part": "context.principal.id",
           "in": [
-            "userId"
+            "developerId"
           ]
         }
       ]
     },
     {
+      "name": "RequestOriginDeny",
       "effect": "deny",
       "actions": [
         {
-          "type": "all",
-          "methods": [
-            "GET"
-          ]
-        },
-        {
-          "type": "none"
-        },
-        {
-          "type": "path",
-          "pattern": ".*"
-        },
-        {
-          "type": "path",
-          "pattern": "#{principal.id}.*"
-        },
+          "type": "all"
+        }
+      ],
+      "conditions": [
         {
           "type": "reg",
-          "pattern": ".*"
-        },
+          "negate": true,
+          "part": "request.origin",
+          "pattern": "^(http|https)://github.com"
+        }
+      ]
+    },
+    {
+      "name": "IpBlacklist",
+      "effect": "deny",
+      "actions": [
         {
-          "type": "reg",
-          "pattern": "#{principal.id}.*"
+          "type": "all"
         }
       ],
       "conditions": [
         {
-          "type": "all"
-        },
-        {
-          "type": "none"
-        },
-        {
-          "type": "spel",
-          "pattern": "context.principal.id=='1'"
-        },
-        {
-          "type": "ognl",
-          "pattern": "path == \"auth/login\""
+          "type": "path",
+          "part": "request.remoteIp",
+          "path": {
+            "caseSensitive": false,
+            "separator": ".",
+            "decodeAndParseSegments": false
+          },
+          "pattern": "192.168.0.*"
         }
       ]
     }
   ]
 }
-
 ```
 
 ## Thanks

diff --git a/README.zh-CN.md b/README.zh-CN.md
@@ -49,95 +49,100 @@
 
 ```json
 {
-  "id": "2",
-  "name": "auth",
-  "category": "auth",
-  "description": "",
+  "id": "id",
+  "name": "name",
+  "category": "category",
+  "description": "description",
   "type": "global",
-  "tenantId": "1",
+  "tenantId": "tenantId",
   "statements": [
     {
+      "name": "Anonymous",
       "effect": "allow",
       "actions": [
         {
-          "type": "all"
+          "type": "path",
+          "pattern": "/auth/register"
         },
         {
-          "type": "none"
-        },
+          "type": "path",
+          "pattern": "/auth/login"
+        }
+      ]
+    },
+    {
+      "name": "UserScope",
+      "effect": "allow",
+      "actions": [
         {
           "type": "path",
-          "methods": [
-            "GET",
-            "POST",
-            "PUT",
-            "DELETE"
-          ],
-          "pattern": "/user/{userId}/*"
+          "pattern": "/user/#{principal.id}/*"
         }
       ],
       "conditions": [
         {
           "type": "authenticated"
-        },
+        }
+      ]
+    },
+    {
+      "name": "Developer",
+      "effect": "allow",
+      "actions": [
+        {
+          "type": "all"
+        }
+      ],
+      "conditions": [
         {
           "type": "in",
           "part": "context.principal.id",
           "in": [
-            "userId"
+            "developerId"
           ]
         }
       ]
     },
     {
+      "name": "RequestOriginDeny",
       "effect": "deny",
       "actions": [
         {
-          "type": "all",
-          "methods": [
-            "GET"
-          ]
-        },
-        {
-          "type": "none"
-        },
-        {
-          "type": "path",
-          "pattern": ".*"
-        },
-        {
-          "type": "path",
-          "pattern": "#{principal.id}.*"
-        },
+          "type": "all"
+        }
+      ],
+      "conditions": [
         {
           "type": "reg",
-          "pattern": ".*"
-        },
+          "negate": true,
+          "part": "request.origin",
+          "pattern": "^(http|https)://github.com"
+        }
+      ]
+    },
+    {
+      "name": "IpBlacklist",
+      "effect": "deny",
+      "actions": [
         {
-          "type": "reg",
-          "pattern": "#{principal.id}.*"
+          "type": "all"
         }
       ],
       "conditions": [
         {
-          "type": "all"
-        },
-        {
-          "type": "none"
-        },
-        {
-          "type": "spel",
-          "pattern": "context.principal.id=='1'"
-        },
-        {
-          "type": "ognl",
-          "pattern": "path == \"auth/login\""
+          "type": "path",
+          "part": "request.remoteIp",
+          "path": {
+            "caseSensitive": false,
+            "separator": ".",
+            "decodeAndParseSegments": false
+          },
+          "pattern": "192.168.0.*"
         }
       ]
     }
   ]
 }
-
 ```
 
 ## 感谢

diff --git a/cosec-api/src/main/kotlin/me/ahoo/cosec/api/policy/Policy.kt b/cosec-api/src/main/kotlin/me/ahoo/cosec/api/policy/Policy.kt
@@ -24,5 +24,5 @@ interface Policy : Named, Tenant {
     val category: String
     val description: String
     val type: PolicyType
-    val statements: Set<Statement>
+    val statements: List<Statement>
 }
diff --git a/cosec-api/src/main/kotlin/me/ahoo/cosec/api/policy/Statement.kt b/cosec-api/src/main/kotlin/me/ahoo/cosec/api/policy/Statement.kt
@@ -13,13 +13,15 @@
 
 package me.ahoo.cosec.api.policy
 
+import me.ahoo.cosec.api.Named
 import me.ahoo.cosec.api.context.SecurityContext
 import me.ahoo.cosec.api.context.request.Request
 
-interface Statement : PermissionVerifier {
+interface Statement : Named, PermissionVerifier {
+    override val name: String
     val effect: Effect
-    val actions: Set<ActionMatcher>
-    val conditions: Set<ConditionMatcher>
+    val actions: List<ActionMatcher>
+    val conditions: List<ConditionMatcher>
 
     override fun verify(request: Request, securityContext: SecurityContext): VerifyResult {
         conditions.all {

diff --git a/cosec-core/src/main/kotlin/me/ahoo/cosec/authorization/SimpleAuthorization.kt b/cosec-core/src/main/kotlin/me/ahoo/cosec/authorization/SimpleAuthorization.kt
@@ -39,11 +39,13 @@ class SimpleAuthorization(private val policyRepository: PolicyRepository) : Auth
         policies.forEach { policy: Policy ->
             policy.statements.filter { statement: Statement ->
                 statement.effect == Effect.DENY
-            }.forEach { statement: Statement ->
+            }.forEachIndexed { index, statement ->
                 val verifyResult = statement.verify(request, context)
                 if (verifyResult == VerifyResult.EXPLICIT_DENY) {
                     if (log.isDebugEnabled) {
-                        log.debug("Verify [$request] [$context] matched Policy[${policy.id}] - [Explicit Deny].")
+                        log.debug(
+                            "Verify [$request] [$context] matched Policy[${policy.id}] Statement[$index][${statement.name}] - [Explicit Deny]."
+                        )
                     }
                     return VerifyResult.EXPLICIT_DENY
                 }
@@ -53,11 +55,13 @@ class SimpleAuthorization(private val policyRepository: PolicyRepository) : Auth
         policies.forEach { policy: Policy ->
             policy.statements.filter { statement: Statement ->
                 statement.effect == Effect.ALLOW
-            }.forEach { statement: Statement ->
+            }.forEachIndexed { index, statement ->
                 val verifyResult = statement.verify(request, context)
                 if (verifyResult == VerifyResult.ALLOW) {
                     if (log.isDebugEnabled) {
-                        log.debug("Verify [$request] [$context] matched Policy[${policy.id}] - [Allow].")
+                        log.debug(
+                            "Verify [$request] [$context] matched Policy[${policy.id}] Statement[$index][${statement.name}] - [Allow]."
+                        )
                     }
                     return VerifyResult.ALLOW
                 }

diff --git a/cosec-core/src/main/kotlin/me/ahoo/cosec/policy/PolicyData.kt b/cosec-core/src/main/kotlin/me/ahoo/cosec/policy/PolicyData.kt
@@ -17,12 +17,31 @@ import me.ahoo.cosec.api.policy.Policy
 import me.ahoo.cosec.api.policy.PolicyType
 import me.ahoo.cosec.api.policy.Statement
 
-data class PolicyData(
+class PolicyData(
     override val id: String,
     override val category: String,
     override val name: String,
     override val description: String,
     override val type: PolicyType,
     override val tenantId: String,
-    override val statements: Set<Statement> = emptySet()
-) : Policy
+    override val statements: List<Statement> = listOf()
+) : Policy {
+
+    override fun equals(other: Any?): Boolean {
+        if (this === other) return true
+        if (javaClass != other?.javaClass) return false
+
+        other as PolicyData
+
+        if (id != other.id) return false
+        if (tenantId != other.tenantId) return false
+
+        return true
+    }
+
+    override fun hashCode(): Int {
+        var result = id.hashCode()
+        result = 31 * result + tenantId.hashCode()
+        return result
+    }
+}