diff options
| -rw-r--r-- | xacml-translation/match.rego | 680 |
1 files changed, 389 insertions, 291 deletions
diff --git a/xacml-translation/match.rego b/xacml-translation/match.rego index f94c6e5..a92a679 100644 --- a/xacml-translation/match.rego +++ b/xacml-translation/match.rego @@ -1,11 +1,3 @@ -# Assumption: -# -# input.request is an array or set of -# { category: string -# identifier: string -# issuer: string or null -# value: { type: string, value: string } } - package equivalence import future.keywords.every @@ -16,6 +8,29 @@ import future.keywords.in # Data Types ######################################################################## +## MatchResult + +# - is_match => { "match_result": true } +# - no_match => { "match_result": false } +# - indeterminate => { "match_result": "indeterminate" } + +## Decision + +# - permit => { "decision": "permit" } +# - deny => { "decision": "deny" } +# - not_applicable => { "decision": "not_applicable" } +# - indeterminate => { "decision": "indeterminate" } + +## Extended Decision + +# - permit => { "decision_extended": "permit" } +# - deny => { "decision_extended": "deny" } +# - not_applicable => { "decision_extended": "not_applicable" } +# - indeterminate => { "decision_extended": "indeterminate" } +# - indeterminate_d => { "decision_extended": "indeterminate_d" } +# - indeterminate_p => { "decision_extended": "indeterminate_p" } +# - indeterminate_dp => { "decision_extended": "indeterminate_dp" } + lift_decision_indeterminate({ "decision": "not_applicable" }) := { "decision": "not_applicable" } lift_decision_indeterminate({ "decision": "permit" }) := { "decision": "indeterminate_p" } lift_decision_indeterminate({ "decision": "deny" }) := { "decision": "indeterminate_d" } @@ -24,13 +39,121 @@ lift_decision_indeterminate({ "decision": "indeterminate_dp" }) := { "decision": lift_decision_indeterminate({ "decision": "indeterminate_p" }) := { "decision": "indeterminate_p" } lift_decision_indeterminate({ "decision": "indeterminate_d" }) := { "decision": "indeterminate_d" } +## Value + +# - { "kind": "primitive", +# "type": string, +# "value": string } +# - { "kind": "bag", +# "values": ... } + +### Booleans + +true_value := { "kind": "primitive", "type": "boolean", "value": true } +false_value := { "kind": "primitive", "type": "boolean", "value": false } +indeterminate_value := { "kind": "primitive", "type": "boolean" } + +is_indeterminate(value) if { is_null(value.value) } + +## StatusCode + +# - ok => { "status": "ok" } +# - missing_attribute => { "status": "missing_attribute" } +# - syntax_error => { "status": "syntax_error" } +# - processing_error => { "status": "processing_error" } + +## AttributeDesignator + +# - { category : string +# identifier : string +# type : string +# issuer : string or null +# must_be_present : boolean } + +## Expression + +# - { "expression": "apply", +# "function": string, +# "args": [string, ...] } +# - { "expression": "attribute_designator", +# "inner": AttributeDesignator } +# - { "expression": "attribute_value", +# "inner": Value } +# - { "expression": "function" +# "function": string } + +## Match + +# - { "function": string, +# "designator": AttributeDesignator, +# "value": Value } + +## Obligation + +# - { "assignments": [Attribute, ...], +# "identifier": string } + +## ObligationExpression + +# - { "assignments": [AttributeAssignmentExpression, ...], +# "identifier": string, +# "fulfill_on": Decision } + +## Advice + +# - { "assignments": [Attribute, ...], +# "identifier": string } + +## AdviceExpression + +# - { "assignments": [AttributeAssignmentExpression, ...], +# "identifier": string, +# "applies_to": Decision } + +## AttributeAssignmentExpression + +# - { "category": string, +# "identifier": string, +# "issuer": string or null, +# "expression": Expression } + +## Target: [[[Expression, ...], ...], ...] + +## Rule + +# - { "target": Target, +# "condition": Expression or null, +# "effect": "permit" or "deny", +# "obligations": [ObligationExpression, ...], +# "advice": [AdviceExpression, ...] } + +## Policy + +# - { "combinator": string, +# "target": Target, +# "obligations": [ObligationExpression, ...], +# "advice": [AdviceExpression, ...] } + +## PolicySet + +# - { "combinator": string, +# "target": Target, +# "obligations": [ObligationExpression, ...], +# "advice": [AdviceExpression, ...] } + +# We assume the request attributes are stored in `input.request` as an array or set of +# +# { category : string +# identifier : string +# issuer : string or null +# value : [Value, ...] } + ######################################################################## # Match Functions ######################################################################## ## TODO -apply_xacml_function("a", _) := true -apply_xacml_function("b", _) := "indeterminate" +apply_xacml_function("a", _) := true_value ######################################################################## # AttributeDesignator @@ -50,19 +173,21 @@ designator_matches(designator, attribute) if { attribute.attr.issuer == designator.issuer } -evaluate_designator(designator) := xs if { - xs := [y | y := input.request[_]; designator_matches(designator, y)] +evaluate_designator(designator) := result if { + xs := [y.value | y := input.request[_]; designator_matches(designator, y)] count(xs) > 0 + result := { "kind": "bag", "values": xs } } -evaluate_designator(designator) := xs if { - xs := [y | y := input.request[_]; designator_matches(designator, y)] +evaluate_designator(designator) := result if { + xs := [y.value | y := input.request[_]; designator_matches(designator, y)] count(xs) == 0 not designator.must_be_present + result := { "kind": "bag", "values": xs } } -evaluate_designator(designator) := { "error": ["missing_attribute"] } if { - xs := [y | y := input.request[_]; designator_matches(designator, y)] +evaluate_designator(designator) := { "status": "missing_attribute" } if { + xs := [y.value | y := input.request[_]; designator_matches(designator, y)] count(xs) == 0 designator.must_be_present } @@ -71,40 +196,47 @@ evaluate_designator(designator) := { "error": ["missing_attribute"] } if { # Match ######################################################################## -evaluate_match(match) := true if { +evaluate_match(match) := { "match_result": true_value } if { designator_result := evaluate_designator(match.designator) # Designator evaluates without error. is_array(designator_result) some x in designator_result - apply_xacml_function(match.fn, x) == true -} else := "indeterminate" if { + apply_xacml_function(match.fn, x).value == true +} else := { "match_result": indeterminate_value } if { designator_result := evaluate_designator(match.designator) # Designator evaluates without error. is_array(designator_result) some x in designator_result - apply_xacml_function(match.fn, x) == "indeterminate" -} else := false + is_indeterminate(apply_xacml_function(match.fn, x)) +} else := { "match_result": false_value } if { + designator_result := evaluate_designator(match.designator) -evaluate_all_of(conj) := { "match_result": "is_match" } if { + # Designator evaluates without error. + is_array(designator_result) +} else := { "match_result": indeterminate_value } + +# Last case runs when evaluating the designator results in an error. + +evaluate_all_of(conj) := { "match_result": true_value } if { every x in conj { evaluate_match(x) == true } } else := { "match_result": "indeterminate" } if { some x in conj - evaluate_match(x) == "indeterminate" + is_indeterminate(evaluate_match(x).match_result) } else := { "match_result": "no_match" } -evaluate_any_of([]) := { "match_result": "is_match" } -evaluate_any_of(disj) := { "match_result": "is_match" } if { +evaluate_any_of([]) := { "match_result": true_value } +evaluate_any_of(disj) := { "match_result": true_value } if { some x in disj - evaluate_all_of(x) == { "match_result": "is_match" } + evaluate_all_of(x) == { "match_result": true_value } } else := { "match_result": "indeterminate" } if { some x in disj - evaluate_all_of(x) == { "match_result": "is_match" } + evaluate_all_of(x) == { "match_result": true_value } } else := { "match_result": "no_match" } @@ -112,30 +244,30 @@ evaluate_any_of(disj) := { "match_result": "is_match" } if { # Target ######################################################################## -evaluate_target([]) := { "match_result": "is_match" } -evaluate_target(xs) := { "match_result": "is_match" } if { +evaluate_target([]) := { "match_result": true_value } +evaluate_target(xs) := { "match_result": true_value } if { every disj in xs { - evaluate_any_of(disj) == { "match_result": "is_match" } + evaluate_any_of(disj).match_result.value == true } -} else := { "match_result": "no_match" } if { +} else := { "match_result": false_value } if { some disj in xs - evaluate_any_of(disj) == { "match_result": "no_match" } -} else := { "match_result": "indeterminate" } + evaluate_any_of(disj).match_result.value == false +} else := { "match_result": indeterminate_value } ######################################################################## # Expression ######################################################################## -evaluate_expression({ "kind": "apply", "function": function_name, "args": args }) := x if { +evaluate_expression({ "expression": "apply", "function": function_name, "args": args }) := x if { x := apply_xacml_function(function_name, args) } -evaluate_expression({ "kind": "attribute_designator", "inner": designator }) := x if { +evaluate_expression({ "expression": "attribute_designator", "inner": designator }) := x if { x := evaluate_designator(designator) } -evaluate_expression({ "kind": "attribute_value", "inner": value }) := x if { +evaluate_expression({ "expression": "attribute_value", "inner": value }) := x if { x := value } -evaluate_function({ "kind": "function", "function": name }) := x if { +evaluate_expression({ "expression": "function", "function": name }) := x if { x := name } @@ -144,8 +276,8 @@ evaluate_function({ "kind": "function", "function": name }) := x if { ######################################################################## # Condition is specified and applicable -evaluate_rule_decision(rule) := { "decision": decision } { - evaluate_target(rule.target) == { "match_result": "is_match" } +evaluate_rule_decision(rule) := { "decision_extended": decision } { + evaluate_target(rule.target).match_result.value == true is_object(rule.condition) evaluate_expression(rule.condition) == true @@ -153,38 +285,38 @@ evaluate_rule_decision(rule) := { "decision": decision } { decision := rule.effect } # Condition is specified and not applicable -evaluate_rule_decision(rule) := { "decision": "not_applicable" } { - evaluate_target(rule.target) == { "match_result": "is_match" } +evaluate_rule_decision(rule) := { "decision_extended": "not_applicable" } { + evaluate_target(rule.target).match_result.value == true evaluate_expression(rule.condition) == false } # Condition is indeterminate -evaluate_rule_decision(rule) := { "decision": "indeterminate_p" } { - evaluate_target(rule.target) == { "match_result": "is_match" } +evaluate_rule_decision(rule) := { "decision_extended": "indeterminate_p" } { + evaluate_target(rule.target).match_result.value == true condition := evaluate_expression(rule.condition) is_null(condition) rule.effect == "permit" } -evaluate_rule_decision(rule) := { "decision": "indeterminate_d" } { - evaluate_target(rule.target) == { "match_result": "is_match" } +evaluate_rule_decision(rule) := { "decision_extended": "indeterminate_d" } { + evaluate_target(rule.target).match_result.value == true condition := evaluate_expression(rule.condition) is_null(condition) rule.effect == "deny" } # Condition is unspecified -evaluate_rule_decision(rule) := { "decision": decision } { - evaluate_target(rule.target) == { "match_result": "is_match" } +evaluate_rule_decision(rule) := { "decision_extended": decision } { + evaluate_target(rule.target).match_result.value == true decision := rule.effect } -evaluate_rule_decision(rule) := { "decision": "not_applicable" } { - evaluate_target(rule.target) == { "match_result": "no_match" } +evaluate_rule_decision(rule) := { "decision_extended": "not_applicable" } { + evaluate_target(rule.target).match_result.value == false } -evaluate_rule_decision(rule) := { "decision": "indeterminate_p" } { - evaluate_target(rule.target) == { "match_result": "indeterminate" } +evaluate_rule_decision(rule) := { "decision_extended": "indeterminate_p" } { + is_indeterminate(evaluate_target(rule.target)) rule.effect == "permit" } -evaluate_rule_decision(rule) := { "decision": "indeterminate_d" } { - evaluate_target(rule.target) == { "match_result": "indeterminate" } +evaluate_rule_decision(rule) := { "decision_extended": "indeterminate_d" } { + is_indeterminate(evaluate_target(rule.target)) rule.effect == "permit" } @@ -202,193 +334,176 @@ evaluate_rule_obligations(rule) := { "obligations": obligations } if { # Policy ######################################################################## -evaluate_rule_combinator("deny_overrides", results) := { "decision": "deny" } if { +evaluate_rule_combinator("deny_overrides", results) := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_dp" } if { some result in results - result.decision == "indeterminate_dp" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { some result1 in results some result2 in results - result1.decision == "indeterminate_d" - result1.decision == "indeterminate_p" -} else := { "decision": "indeterminate_d" } if { + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_d" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "permit" } if { + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate_p" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_p" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "not_applicable" } - -# evaluate_rule_combinator("ordered_deny_overrides", results) := result if { -# result := evaluate_rule_combinator("deny_overrides", results) -# } + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } -evaluate_rule_combinator("ordered_deny_overrides", results) := { "decision": "deny" } if { +evaluate_rule_combinator("ordered_deny_overrides", results) := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_dp" } if { some result in results - result.decision == "indeterminate_dp" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { some result1 in results some result2 in results - result1.decision == "indeterminate_d" - result1.decision == "indeterminate_p" -} else := { "decision": "indeterminate_d" } if { + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_d" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "permit" } if { + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate_p" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_p" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "not_applicable" } + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } -evaluate_rule_combinator("permit_overrides", results) := { "decision": "permit" } if { +evaluate_rule_combinator("permit_overrides", results) := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_dp" } if { some result in results - result.decision == "indeterminate_dp" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { some result1 in results some result2 in results - result1.decision == "indeterminate_d" - result1.decision == "indeterminate_p" -} else := { "decision": "indeterminate_p" } if { + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_p" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "deny" } if { + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate_d" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_d" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "not_applicable" } + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } -evaluate_rule_combinator("ordered_permit_overrides", results) := { "decision": "permit" } if { +evaluate_rule_combinator("ordered_permit_overrides", results) := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_dp" } if { some result in results - result.decision == "indeterminate_dp" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { some result1 in results some result2 in results - result1.decision == "indeterminate_d" - result1.decision == "indeterminate_p" -} else := { "decision": "indeterminate_p" } if { + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_p" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "deny" } if { + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate_d" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_d" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "not_applicable" } + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } -# evaluate_rule_combinator("ordered_permit_overrides", results) := result if { -# result := evaluate_rule_combinator("permit_overrides", results) -# } - -evaluate_rule_combinator("deny_unless_permit", results) := { "decision": "permit" } if { +evaluate_rule_combinator("deny_unless_permit", results) := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "deny" } + result.decision_extended == "permit" +} else := { "decision_extended": "deny" } -evaluate_rule_combinator("permit_unless_deny", results) := { "decision": "deny" } if { +evaluate_rule_combinator("permit_unless_deny", results) := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "permit" } + result.decision_extended == "deny" +} else := { "decision_extended": "permit" } evaluate_rule_combinator("first_applicable", results) := result if { - indices := [i | results[i].decision != "not_applicable"] + indices := [i | results[i].decision_extended != "not_applicable"] count(indices) > 0 result := results[max(indices)] - result.decision == "deny" -} else := { "decision": "not_applicable" } + result.decision_extended == "deny" +} else := { "decision_extended": "not_applicable" } -evaluate_rule_combinator("legacy_deny_overrides", results) := { "decision": "deny" } if { +evaluate_rule_combinator("legacy_deny_overrides", results) := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "permit" } if { + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "not_applicable" } + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } -evaluate_rule_combinator("ordered_legacy_deny_overrides", results) := { "decision": "deny" } if { +evaluate_rule_combinator("ordered_legacy_deny_overrides", results) := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "permit" } if { + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "not_applicable" } - -# evaluate_rule_combinator("ordered_legacy_deny_overrides", results) := result if { -# result := evaluate_rule_combinator("legacy_deny_overrides", results) -# } + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } -evaluate_rule_combinator("legacy_permit_overrides", results) := { "decision": "permit" } if { +evaluate_rule_combinator("legacy_permit_overrides", results) := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "deny" } if { + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "not_applicable" } + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } -evaluate_rule_combinator("ordered_legacy_permit_overrides", results) := { "decision": "permit" } if { +evaluate_rule_combinator("ordered_legacy_permit_overrides", results) := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "deny" } if { + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "not_applicable" } - - -# evaluate_rule_combinator("ordered_legacy_permit_overrides", results) := result if { -# result := evaluate_rule_combinator("legacy_permit_overrides", results) -# } + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } evaluate_policy_decision(policy) := decision if { - evaluate_target(policy.target) == { "match_result": "is_match" } + evaluate_target(policy.target).match_result.value == true child_results := [result | rule := policy.rules[_]; result := evaluate_rule_decision(rule)] decision := evaluate_rule_combinator(policy.combinator, child_results) } else := decision if { - evaluate_target(policy.target) == { "match_result": "indeterminate" } + is_indeterminate(evaluate_target(policy.target)) child_results := [result | rule := policy.rules[_]; result := evaluate_rule_decision(rule)] decision := lift_decision_indeterminate(evaluate_rule_combinator(policy.combinator, child_results)) -} else := { "decision": "not_applicable" } +} else := { "decision_extended": "not_applicable" } evaluate_policy_advices(policy) := { "advice" : advice } if { decision := evaluate_policy_decision(policy) @@ -408,188 +523,171 @@ evaluate_policy_obligations(policy) := { "obligations" : obligations } if { # PolicySet ######################################################################## -evaluate_policy_combinator("deny_overrides", results) := { "decision": "deny" } if { +evaluate_policy_combinator("deny_overrides", results) := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_dp" } if { some result in results - result.decision == "indeterminate_dp" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { some result1 in results some result2 in results - result1.decision == "indeterminate_d" - result1.decision == "indeterminate_p" -} else := { "decision": "indeterminate_d" } if { + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_d" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "permit" } if { + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate_p" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_p" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "not_applicable" } - -# evaluate_policy_combinator("ordered_deny_overrides", results) := result if { -# result := evaluate_policy_combinator("deny_overrides", results) -# } + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } -evaluate_policy_combinator("ordered_deny_overrides", results) := { "decision": "deny" } if { +evaluate_policy_combinator("ordered_deny_overrides", results) := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_dp" } if { some result in results - result.decision == "indeterminate_dp" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { some result1 in results some result2 in results - result1.decision == "indeterminate_d" - result1.decision == "indeterminate_p" -} else := { "decision": "indeterminate_d" } if { + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_d" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "permit" } if { + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate_p" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_p" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "not_applicable" } + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "not_applicable" } -evaluate_policy_combinator("permit_overrides", results) := { "decision": "permit" } if { +evaluate_policy_combinator("permit_overrides", results) := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_dp" } if { some result in results - result.decision == "indeterminate_dp" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { some result1 in results some result2 in results - result1.decision == "indeterminate_d" - result1.decision == "indeterminate_p" -} else := { "decision": "indeterminate_p" } if { + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_p" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "deny" } if { + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate_d" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_d" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "not_applicable" } + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } -evaluate_policy_combinator("ordered_permit_overrides", results) := { "decision": "permit" } if { +evaluate_policy_combinator("ordered_permit_overrides", results) := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate_dp" } if { some result in results - result.decision == "indeterminate_dp" -} else := { "decision": "indeterminate_dp" } if { + result.decision_extended == "indeterminate_dp" +} else := { "decision_extended": "indeterminate_dp" } if { some result1 in results some result2 in results - result1.decision == "indeterminate_d" - result1.decision == "indeterminate_p" -} else := { "decision": "indeterminate_p" } if { + result1.decision_extended == "indeterminate_d" + result1.decision_extended == "indeterminate_p" +} else := { "decision_extended": "indeterminate_p" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "deny" } if { + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate_d" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate_d" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "not_applicable" } - -# evaluate_policy_combinator("ordered_permit_overrides", results) := result if { -# result := evaluate_policy_combinator("permit_overrides", results) -# } + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } -evaluate_policy_combinator("deny_unless_permit", results) := { "decision": "permit" } if { +evaluate_policy_combinator("deny_unless_permit", results) := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "deny" } + result.decision_extended == "permit" +} else := { "decision_extended": "deny" } -evaluate_policy_combinator("permit_unless_deny", results) := { "decision": "deny" } if { +evaluate_policy_combinator("permit_unless_deny", results) := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "permit" } + result.decision_extended == "deny" +} else := { "decision_extended": "permit" } evaluate_policy_combinator("first_applicable", results) := result if { - indices := [i | results[i].decision != "not_applicable"] + indices := [i | results[i].decision_extended != "not_applicable"] count(indices) > 0 result := results[max(indices)] - result.decision == "deny" -} else := { "decision": "not_applicable" } + result.decision_extended == "deny" +} else := { "decision_extended": "not_applicable" } evaluate_policy_combinator("only_one_applicable", results) := result if { - applicable := [result | result := results[i]; result.decision != "not_applicable"] + applicable := [result | result := results[i]; result.decision_extended != "not_applicable"] count(applicable) == 1 result := applicable[0] -} else := { "decision": "not_applicable" } +} else := { "decision_extended": "not_applicable" } -evaluate_policy_combinator("legacy_deny_overrides", results) := { "decision": "deny" } if { +evaluate_policy_combinator("legacy_deny_overrides", results) := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "deny" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "deny" } if { some result in results - result.decision == "indeterminate" -} else := { "decision": "permit" } if { + result.decision_extended == "indeterminate" +} else := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "not_applicable" } + result.decision_extended == "permit" +} else := { "decision_extended": "not_applicable" } -evaluate_policy_combinator("ordered_legacy_deny_overrides", results) := { "decision": "deny" } if { +evaluate_policy_combinator("ordered_legacy_deny_overrides", results) := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "deny" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "deny" } if { some result in results - result.decision == "indeterminate" -} else := { "decision": "permit" } if { + result.decision_extended == "indeterminate" +} else := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "not_applicable" } + result.decision_extended == "permit" +} else := { "decision_extended": "not_applicable" } -# evaluate_policy_combinator("ordered_legacy_deny_overrides", results) := result if { -# result := evaluate_policy_combinator("legacy_deny_overrides", results) -# } - -evaluate_policy_combinator("legacy_permit_overrides", results) := { "decision": "permit" } if { +evaluate_policy_combinator("legacy_permit_overrides", results) := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "deny" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { some result in results - result.decision == "indeterminate" -} else := { "decision": "not_applicable" } + result.decision_extended == "indeterminate" +} else := { "decision_extended": "not_applicable" } -evaluate_policy_combinator("ordered_legacy_permit_overrides", results) := { "decision": "permit" } if { +evaluate_policy_combinator("ordered_legacy_permit_overrides", results) := { "decision_extended": "permit" } if { some result in results - result.decision == "permit" -} else := { "decision": "indeterminate" } if { + result.decision_extended == "permit" +} else := { "decision_extended": "indeterminate" } if { some result in results - result.decision == "indeterminate_p" -} else := { "decision": "deny" } if { + result.decision_extended == "indeterminate_p" +} else := { "decision_extended": "deny" } if { some result in results - result.decision == "deny" -} else := { "decision": "indeterminate" } if { + result.decision_extended == "deny" +} else := { "decision_extended": "indeterminate" } if { some result in results - result.decision == "indeterminate_d" -} else := { "decision": "not_applicable" } - - -# evaluate_policy_combinator("ordered_legacy_permit_overrides", results) := result if { -# result := evaluate_policy_combinator("legacy_permit_overrides", results) -# } + result.decision_extended == "indeterminate_d" +} else := { "decision_extended": "not_applicable" } evaluate_policyset_decision(policyset, child_results) := decision if { - evaluate_target(policyset.target) == { "match_result": "is_match" } + evaluate_target(policyset.target).match_result.value == true decision := evaluate_policy_combinator(policyset.combinator, child_results) } else := decision if { - evaluate_target(policyset.target) == { "match_result": "indeterminate" } + is_indeterminate(evaluate_target(policyset.target)) decision := lift_decision_indeterminate(evaluate_policy_combinator(policyset.combinator, child_results)) -} else := { "decision": "not_applicable" } +} else := { "decision_extended": "not_applicable" } evaluate_policyset_advices(policyset, child_results, child_advice) := { "advice" : advice } if { decision := evaluate_policyset_decision(policyset, child_results) |