Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Conditional execution of authorizers, contextualizers and unifiers in a rule #562

Merged
merged 21 commits into from
Apr 14, 2023

Conversation

dadrus
Copy link
Owner

@dadrus dadrus commented Apr 14, 2023

Related issue(s)

closes #521

Checklist

  • I agree to follow this project's Code of Conduct.
  • I have read, and I am following this repository's Contributing Guidelines.
  • I have read the Security Policy.
  • I have referenced an issue describing the bug/feature request.
  • I have added tests that prove the correctness of my implementation.
  • I have updated the documentation.

Description

This PR implements the option 2 described in #521, which makes the following configuration possible:

- id: some_service_rule
  match:
    url: http://127.0.0.1:9090/foo/bar
  methods:
    - GET
    - POST
    - PUT
  execute:
    - authenticator: cookie_session
    - authenticator: anonymous
    # the next contextualizer executes only if the request is not anonymous
    - contextualizer: subscription_plan
      if: Subject.ID != "anonymous"
    # the next authorizer executes only if the request is an anonymous read request
    - authorizer: allow_all
      if: Subject.ID == "anonymous" && Request.Method == "GET"
    # the next authorizer executes only if the request is an anonymous write request
    - authorizer: deny_all
      if: Subject.ID == "anonymous" && (Request.Method == "POST" || Request.Method == "PUT")
    # the next authorizer executes only if the request is a write request
    - authorizer: can_write
      if: Request.Method == "POST" || Request.Method == "PUT" 
    - unifier: jwt_unifier

Conditional execution of unifiers is possible as well (can make the go templates less verbose if required)

@dadrus dadrus changed the title feat: Conditional execution of mechanisms in a pipeline feat: Support for conditional execution of authorizers, contextualizers and unifiers in a pipeline Apr 14, 2023
@dadrus dadrus changed the title feat: Support for conditional execution of authorizers, contextualizers and unifiers in a pipeline wip: Support for conditional execution of authorizers, contextualizers and unifiers in a pipeline Apr 14, 2023
@dadrus dadrus changed the title wip: Support for conditional execution of authorizers, contextualizers and unifiers in a pipeline wip: Support for conditional execution of authorizers, contextualizers and unifiers in a rule Apr 14, 2023
@codecov
Copy link

codecov bot commented Apr 14, 2023

Codecov Report

Merging #562 (5659df8) into main (7a6bc17) will decrease coverage by 0.12%.
The diff coverage is 87.71%.

@@            Coverage Diff             @@
##             main     #562      +/-   ##
==========================================
- Coverage   89.33%   89.22%   -0.12%     
==========================================
  Files         210      213       +3     
  Lines        8915     8989      +74     
==========================================
+ Hits         7964     8020      +56     
- Misses        764      778      +14     
- Partials      187      191       +4     
Impacted Files Coverage Δ
internal/rules/default_execution_condition.go 0.00% <0.00%> (ø)
internal/rules/cel_execution_condition.go 65.62% <65.62%> (ø)
internal/rules/rule_factory_impl.go 96.83% <98.61%> (+0.45%) ⬆️
internal/rules/conditional_subject_handler.go 100.00% <100.00%> (ø)

... and 1 file with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

@dadrus dadrus changed the title wip: Support for conditional execution of authorizers, contextualizers and unifiers in a rule feat: Support for conditional execution of authorizers, contextualizers and unifiers in a rule Apr 14, 2023
@dadrus dadrus changed the title feat: Support for conditional execution of authorizers, contextualizers and unifiers in a rule feat: Conditional execution of authorizers, contextualizers and unifiers in a rule Apr 14, 2023
@dadrus dadrus merged commit 72db66e into main Apr 14, 2023
@dadrus dadrus deleted the feat/conditional_mechanism_execution branch April 14, 2023 23:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
1 participant