Fix match evaluation

1 files changed, 42 insertions, 16 deletions

diff --git a/xacml-translation/xacml.rego b/xacml-translation/xacml.rego
index b5ba0ff..8cbeb31 100644
--- a/xacml-translation/xacml.rego
+++ b/xacml-translation/xacml.rego
@@ -152,8 +152,24 @@ is_indeterminate(value) if { is_null(value.value) }
 # Match Functions
 ########################################################################
 
-## TODO
-apply_xacml_function("urn:oasis:names:tc:xacml:1.0:function:string-equal", [("http://www.w3.org/2001/XMLSchema#string", a), ("http://www.w3.org/2001/XMLSchema#string", b)]) := true_value if {
+apply_xacml_function(
+    "urn:oasis:names:tc:xacml:1.0:function:string-equal",
+    [{ "kind": "primitive",
+       "type": "http://www.w3.org/2001/XMLSchema#string",
+       "value": a },
+     { "kind": "primitive",
+       "type": "http://www.w3.org/2001/XMLSchema#string",
+       "value": b }]) := true_value if {
+  a == b
+} else := false_value
+apply_xacml_function(
+    "urn:oasis:names:tc:xacml:1.0:function:anyURI-equal",
+    [{ "kind": "primitive",
+       "type": "http://www.w3.org/2001/XMLSchema#anyURI",
+       "value": a },
+     { "kind": "primitive",
+       "type": "http://www.w3.org/2001/XMLSchema#anyURI",
+       "value": b }]) := true_value if {
   a == b
 } else := false_value
 
@@ -165,7 +181,7 @@ designator_matches(designator, attribute) if {
     attribute.category    == designator.category
     attribute.identifier  == designator.identifier
     attribute.value.type  == designator.type
-    attribute.attr.issuer == null
+    not attribute.attr.issuer
 }
 
 designator_matches(designator, attribute) if {
@@ -175,17 +191,20 @@ designator_matches(designator, attribute) if {
     attribute.attr.issuer == designator.issuer
 }
 
-evaluate_designator(designator) := result if {
+evaluate_designator(designator) := { "kind": "bag", "values": xs } if {
+    xs := [y.value | y := input.request[_]; designator_matches(designator, y)]
+    count(xs) > 1
+}
+
+evaluate_designator(designator) := xs[0] if {
     xs := [y.value | y := input.request[_]; designator_matches(designator, y)]
-    count(xs) > 0
-    result := { "kind": "bag", "values": xs }
+    count(xs) == 1
 }
 
-evaluate_designator(designator) := result if {
+evaluate_designator(designator) := { "kind": "bag", "values": xs } if {
     xs := [y.value | y := input.request[_]; designator_matches(designator, y)]
     count(xs) == 0
     not designator.must_be_present
-    result := { "kind": "bag", "values": xs }
 }
 
 evaluate_designator(designator) := { "status": "missing_attribute" } if {
@@ -202,30 +221,37 @@ evaluate_match(match) := { "match_result": true_value } if {
     designator_result := evaluate_designator(match.designator)
 
     # Designator evaluates without error.
-    is_array(designator_result)
+    designator_result
 
-    some x in designator_result
-    apply_xacml_function(match.fn, x).value == true
+    some x in designator_result.values
+    apply_xacml_function(match.function, [x, match.value]).value == true
+} else := { "match_result": true_value } if {
+    designator_result := evaluate_designator(match.designator)
+
+    # Designator evaluates without error.
+    designator_result
+
+    apply_xacml_function(match.function, [designator_result, match.value]).value == true
 } else := { "match_result": indeterminate_value } if {
     designator_result := evaluate_designator(match.designator)
 
     # Designator evaluates without error.
-    is_array(designator_result)
+    designator_result
 
     some x in designator_result
-    is_indeterminate(apply_xacml_function(match.fn, x))
+    is_indeterminate(apply_xacml_function(match.function, [x, match.value]))
 } else := { "match_result": false_value } if {
     designator_result := evaluate_designator(match.designator)
 
     # Designator evaluates without error.
-    is_array(designator_result)
+    designator_result
 } else := { "match_result": indeterminate_value }
 
 # Last case runs when evaluating the designator results in an error.
 
 evaluate_all_of(conj) := { "match_result": true_value } if {
     every x in conj {
-        evaluate_match(x) == true
+        evaluate_match(x).match_result.value == true
     }
 } else := { "match_result": "indeterminate" } if {
     some x in conj
@@ -253,7 +279,7 @@ evaluate_target(xs) := { "match_result": true_value } if {
     }
 } else := { "match_result": false_value } if {
     some disj in xs
-    evaluate_any_of(disj).match_result.value == false
+    evaluate_any_of(disj).match_result == "no_match"
 } else := { "match_result": indeterminate_value }
 
 ########################################################################