Refactor: (Context)ConditionMatcher (#53)

README.md

@@ -29,6 +29,16 @@ RBAC-based And Policy-based Multi-Tenant Reactive Security Framework.
 
 ![Gateway](document/design/assets/Gateway.svg)
 
+## Build In Policy
+
+### ActionMatcher
+
+![ActionMatcher](document/design/assets/ActionMatcher.svg)
+
+### ConditionMatcher
+
+![ConditionMatcher](document/design/assets/ConditionMatcher.svg)
+
 ## Policy Schema
 
 [Policy Schema](document/cosec-policy.schema.json)

README.zh-CN.md

@@ -29,6 +29,17 @@
 
 ![Gateway](document/design/assets/Gateway.svg)
 
+## 内置策略匹配器
+
+### ActionMatcher
+
+![ActionMatcher](document/design/assets/ActionMatcher.svg)
+
+### ConditionMatcher
+
+![ConditionMatcher](document/design/assets/ConditionMatcher.svg)
+
+
 ## 策略 Schema
 
 [Policy Schema](document/cosec-policy.schema.json)

cosec-core/src/main/kotlin/me/ahoo/cosec/policy/condition/context/AuthenticatedConditionMatcher.kt

@@ -17,13 +17,14 @@ import me.ahoo.cosec.api.configuration.Configuration
 import me.ahoo.cosec.api.context.SecurityContext
 import me.ahoo.cosec.api.context.request.Request
 import me.ahoo.cosec.api.policy.ConditionMatcher
+import me.ahoo.cosec.policy.condition.AbstractConditionMatcher
 import me.ahoo.cosec.policy.condition.ConditionMatcherFactory
 
-class AuthenticatedConditionMatcher(override val configuration: Configuration) : ConditionMatcher {
+class AuthenticatedConditionMatcher(configuration: Configuration) : AbstractConditionMatcher(configuration) {
     override val type: String
         get() = AuthenticatedConditionMatcherFactory.TYPE
 
-    override fun match(request: Request, securityContext: SecurityContext): Boolean {
+    override fun internalMatch(request: Request, securityContext: SecurityContext): Boolean {
         return securityContext.principal.authenticated()
     }
 }

cosec-core/src/main/kotlin/me/ahoo/cosec/policy/condition/context/InDefaultTenantConditionMatcher.kt

@@ -17,13 +17,14 @@ import me.ahoo.cosec.api.configuration.Configuration
 import me.ahoo.cosec.api.context.SecurityContext
 import me.ahoo.cosec.api.context.request.Request
 import me.ahoo.cosec.api.policy.ConditionMatcher
+import me.ahoo.cosec.policy.condition.AbstractConditionMatcher
 import me.ahoo.cosec.policy.condition.ConditionMatcherFactory
 
-class InDefaultTenantConditionMatcher(override val configuration: Configuration) : ConditionMatcher {
+class InDefaultTenantConditionMatcher(configuration: Configuration) : AbstractConditionMatcher(configuration) {
     override val type: String
         get() = InDefaultTenantConditionMatcherFactory.TYPE
 
-    override fun match(request: Request, securityContext: SecurityContext): Boolean {
+    override fun internalMatch(request: Request, securityContext: SecurityContext): Boolean {
         return securityContext.tenant.isDefaultTenant
     }
 }

cosec-core/src/main/kotlin/me/ahoo/cosec/policy/condition/context/InPlatformTenantConditionMatcher.kt

@@ -17,13 +17,14 @@ import me.ahoo.cosec.api.configuration.Configuration
 import me.ahoo.cosec.api.context.SecurityContext
 import me.ahoo.cosec.api.context.request.Request
 import me.ahoo.cosec.api.policy.ConditionMatcher
+import me.ahoo.cosec.policy.condition.AbstractConditionMatcher
 import me.ahoo.cosec.policy.condition.ConditionMatcherFactory
 
-class InPlatformTenantConditionMatcher(override val configuration: Configuration) : ConditionMatcher {
+class InPlatformTenantConditionMatcher(configuration: Configuration) : AbstractConditionMatcher(configuration) {
     override val type: String
         get() = InPlatformTenantConditionMatcherFactory.TYPE
 
-    override fun match(request: Request, securityContext: SecurityContext): Boolean {
+    override fun internalMatch(request: Request, securityContext: SecurityContext): Boolean {
         return securityContext.tenant.isPlatformTenant
     }
 }

cosec-core/src/main/kotlin/me/ahoo/cosec/policy/condition/context/InUserTenantConditionMatcher.kt

@@ -17,13 +17,14 @@ import me.ahoo.cosec.api.configuration.Configuration
 import me.ahoo.cosec.api.context.SecurityContext
 import me.ahoo.cosec.api.context.request.Request
 import me.ahoo.cosec.api.policy.ConditionMatcher
+import me.ahoo.cosec.policy.condition.AbstractConditionMatcher
 import me.ahoo.cosec.policy.condition.ConditionMatcherFactory
 
-class InUserTenantConditionMatcher(override val configuration: Configuration) : ConditionMatcher {
+class InUserTenantConditionMatcher(configuration: Configuration) : AbstractConditionMatcher(configuration) {
     override val type: String
         get() = InUserTenantConditionMatcherFactory.TYPE
 
-    override fun match(request: Request, securityContext: SecurityContext): Boolean {
+    override fun internalMatch(request: Request, securityContext: SecurityContext): Boolean {
         return securityContext.tenant.isUserTenant
     }
 }

document/design/uml/ActionMatcher.puml

@@ -0,0 +1,31 @@
+@startuml
+
+!include layout.puml
+
+title Build In ActionMatcher
+
+interface RequestMatcher{
+    val type: String
+    val configuration: Configuration
+    match(request: Request, securityContext: SecurityContext): Boolean
+}
+interface ActionMatcher
+abstract class AbstractActionMatcher{
+    val methods: Set<String>
+}
+class AllActionMatcher
+class NoneActionMatcher
+class PathActionMatcher
+class RegularActionMatcher
+class ReplaceablePathActionMatcher
+class ReplaceableRegularActionMatcher
+
+RequestMatcher <|-- ActionMatcher
+ActionMatcher  <|-- AbstractActionMatcher
+AbstractActionMatcher <|-- AllActionMatcher
+AbstractActionMatcher <|-- NoneActionMatcher
+AbstractActionMatcher <|-- PathActionMatcher
+AbstractActionMatcher <|-- RegularActionMatcher
+AbstractActionMatcher <|-- ReplaceablePathActionMatcher
+AbstractActionMatcher <|-- ReplaceableRegularActionMatcher
+@enduml

document/design/uml/ConditionMatcher.puml

@@ -0,0 +1,48 @@
+@startuml
+
+!include layout.puml
+
+title Build In ConditionMatcher
+
+interface RequestMatcher{
+    val type: String
+    val configuration: Configuration
+    match(request: Request, securityContext: SecurityContext): Boolean
+}
+
+interface ConditionMatcher
+abstract class AbstractConditionMatcher{
+    val negate: Boolean
+}
+abstract class PartConditionMatcher{
+    val partExtractor: PartExtractor
+}
+class AllConditionMatcher
+class AuthenticatedConditionMatcher
+class EqConditionMatcher
+class InConditionMatcher
+class InDefaultTenantConditionMatcher
+class InPlatformTenantConditionMatcher
+class InUserTenantConditionMatcher
+class NoneConditionMatcher
+class OgnlConditionMatcher
+class PathConditionMatcher
+class RegularConditionMatcher
+class SpelConditionMatcher
+
+RequestMatcher <|-- ConditionMatcher
+ConditionMatcher <|-- AbstractConditionMatcher
+AbstractConditionMatcher <|-- PartConditionMatcher
+PartConditionMatcher <|-- InConditionMatcher
+PartConditionMatcher <|-- EqConditionMatcher
+PartConditionMatcher <|-- PathConditionMatcher
+PartConditionMatcher <|-- RegularConditionMatcher
+AbstractConditionMatcher <|-- AuthenticatedConditionMatcher
+AbstractConditionMatcher <|-- InDefaultTenantConditionMatcher
+AbstractConditionMatcher <|-- SpelConditionMatcher
+AbstractConditionMatcher <|-- OgnlConditionMatcher
+AbstractConditionMatcher <|-- InUserTenantConditionMatcher
+AbstractConditionMatcher <|-- NoneConditionMatcher
+AbstractConditionMatcher <|-- AllConditionMatcher
+AbstractConditionMatcher <|-- InPlatformTenantConditionMatcher
+@enduml

document/design/uml/authorization-flow.puml

@@ -5,7 +5,6 @@ title Authorization Flow
 participant User
 participant AuthorizationFilter
 participant RequestParser
-participant TenantParser
 participant SecurityContextParser
 participant TokenVerifier
 participant Authorization
@@ -14,8 +13,6 @@ User++
 
 User -> AuthorizationFilter++: request()
 AuthorizationFilter -> RequestParser++: parse()
-RequestParser -> TenantParser++: parse()
-RequestParser <-- TenantParser--: Tenant
 AuthorizationFilter <-- RequestParser--: Request
 AuthorizationFilter -> SecurityContextParser++: parse()
 SecurityContextParser -> TokenVerifier++: verify(AccessToken)

document/design/uml/modeling.puml

@@ -125,18 +125,14 @@ package context{
     TenantCapable <|--  SecurityContext
     CoSecPrincipal --* SecurityContext
 
-    interface Request<A : Any>{
-        val action: A
+    interface Request{
+        val path: String
+        val method: String
+        val remoteIp: String
+        val origin: String
+        val referer: String
+        getHeader(key: String): String
     }
-
-    interface HttpRequest
-    TenantCapable <|-- Request
-    Request <|--  HttpRequest
-
-    note right of HttpRequest
-        HttpRequest::action
-        format: {url}:{method}
-    end note
 }
 
 package authorization{

gradle.properties

@@ -11,7 +11,7 @@
 # limitations under the License.
 #
 group=me.ahoo.cosec
-version=1.8.6
+version=1.8.7
 description=RBAC-based And Policy-based Multi-Tenant Reactive Security Framework
 website=https://github.com/Ahoo-Wang/CoSec
 issues=https://github.com/Ahoo-Wang/CoSec/issues