How to get a specific action for the given rule based on the input resource, input action and the user accessible actions based on the roles defined.

[naveenkulkarni029]

Hello Everyone,

I have a situation where i would like to get a response based on the action and the resource. I am not able to match a specific response action for the response that is structure. For more details i have attached the playground link which i have used to test the rule.

Playground Area.

Below is the more details about the requirement.

When a user makes a call to get a product price for a specific product.

{
    "action": "get",
    "resource": "products.price.1234"
}

Assuming the below are the list of decisions a user can perform based on the roles assigned for the user.

entz := [
{
	"ucdw": [
			{
				"action": "get",
				"connective": "include",
				"outcome": "allow",
				"resource": "orders.*",
			},
			{
				"action": "get",
				"connective": "include",
				"outcome": "allow",
				"resource": "products.*",
			},
                       {
				"action": "get",
				"connective": "include",
				"outcome": "allow",
				"resource": "products.price.*",
			},
                        {
				"action": "get",
				"connective": "include",
				"outcome": "allow",
				"resource": "orders.*.price.*",
			},
			{
				"action": "post",
				"connective": "include",
				"outcome": "allow",
				"resource": "orders",
			},
			{
				"action": "post",
				"connective": "include",
				"outcome": "allow",
				"resource": "orders.*.price",
			},
			{
				"action": "post",
				"connective": "include",
				"outcome": "allow",
				"resource": "products",
			},
		],
}]

I would now like to compare each decision with the input requested and return an exact match for the user from a data source.

{
    "actions": {
        "orders": {
            "post": "manage_orders"
        },
        "orders.*": {
            "get": "view_orders"
        },
        "orders.*.price": {
            "post": "manage_price"
        },
        "orders.*.price.*": {
            "get": "view_price"
        },
        "products": {
            "post": "manage_products"
        },
        "products.*": {
            "get": "view_products"
        },
        "products.price.*": {
            "get": "manage_products_price"
        }
    }
}

Below is the current logic in have to get the response from the rule.

c := {k: {"responseAction":responseAction,"responseResource":responseResource, "resource_action_response":resource_action_response} |
	some k
    #input.action == entz[_].ucdw[k].action
    #regex.match(entz[_].ucdw[k].resource, input.resource)
	responseAction := entz[_].ucdw[k].action
    responseResource := entz[_].ucdw[k].resource
    #count := indexof_n(input.resource, ".")
    input.action == responseAction
    regex.match(responseResource, input.resource)
    
    resource_action_response :=data.actions[responseResource][responseAction]
    
}

decision := {
    "ct_action_resource_action": c,
    "entz": entz,
    "message": "Lol",
    "tom": "jerry"
  }
}

Expected Output:

{
	"enforce": [
		{
			"expected_action_on_resource_action": {
				"resource_action_response": "manage_products_price",
				"responseAction": "get",
				"responseResource": "products.price.*"
			},
			"entz": [
				{
					"ucdw": [
						{
							"action": "get",
							"connective": "include",
							"outcome": "allow",
							"resource": "orders.*"
						},
						{
							"action": "get",
							"connective": "include",
							"outcome": "allow",
							"resource": "products.*"
						},
						{
							"action": "get",
							"connective": "include",
							"outcome": "allow",
							"resource": "products.price.*"
						},
						{
							"action": "get",
							"connective": "include",
							"outcome": "allow",
							"resource": "orders.*.price.*"
						},
						{
							"action": "post",
							"connective": "include",
							"outcome": "allow",
							"resource": "orders"
						},
						{
							"action": "post",
							"connective": "include",
							"outcome": "allow",
							"resource": "orders.*.price"
						},
						{
							"action": "post",
							"connective": "include",
							"outcome": "allow",
							"resource": "products"
						}
					]
				}
			],
			"message": "Lol",
			"tom": "jerry"
		}
	]
}

Actual Response:

The current response is matching all the resources with a wild card.

Reference:

{
    "enforce": [
        {
            "ct_action_resource_action": {
                "1": {
                    "resource_action_response": "view_products",
                    "responseAction": "get",
                    "responseResource": "products.*"
                },
                "2": {
                    "resource_action_response": "manage_products_price",
                    "responseAction": "get",
                    "responseResource": "products.price.*"
                }
            },
            "entz": [
                {
                    "ucdw": [
                        {
                            "action": "get",
                            "connective": "include",
                            "outcome": "allow",
                            "resource": "orders.*"
                        },
                        {
                            "action": "get",
                            "connective": "include",
                            "outcome": "allow",
                            "resource": "products.*"
                        },
                        {
                            "action": "get",
                            "connective": "include",
                            "outcome": "allow",
                            "resource": "products.price.*"
                        },
                        {
                            "action": "get",
                            "connective": "include",
                            "outcome": "allow",
                            "resource": "orders.*.price.*"
                        },
                        {
                            "action": "post",
                            "connective": "include",
                            "outcome": "allow",
                            "resource": "orders"
                        },
                        {
                            "action": "post",
                            "connective": "include",
                            "outcome": "allow",
                            "resource": "orders.*.price"
                        },
                        {
                            "action": "post",
                            "connective": "include",
                            "outcome": "allow",
                            "resource": "products"
                        }
                    ]
                }
            ],
            "message": "Lol",
            "tom": "jerry"
        }
    ]
}

NOTE: It would be of great help if it is possible for me to understand if we can get the response action directly outside the object as mentioned below.

{
	"enforce": [
			"entz": [
				{
					"ucdw": [
						{
							"action": "get",
							"connective": "include",
							"outcome": "allow",
							"resource": "orders.*"
						},
						{
							"action": "get",
							"connective": "include",
							"outcome": "allow",
							"resource": "products.*"
						},
						{
							"action": "get",
							"connective": "include",
							"outcome": "allow",
							"resource": "products.price.*"
						},
						{
							"action": "get",
							"connective": "include",
							"outcome": "allow",
							"resource": "orders.*.price.*"
						},
						{
							"action": "post",
							"connective": "include",
							"outcome": "allow",
							"resource": "orders"
						},
						{
							"action": "post",
							"connective": "include",
							"outcome": "allow",
							"resource": "orders.*.price"
						},
						{
							"action": "post",
							"connective": "include",
							"outcome": "allow",
							"resource": "products"
						}
					]
				}
			],
			"message": "Lol",
			"tom": "jerry",
			"expected_action_on_resource_action": "manage_products_price"
		}
	]
}

[johanfylling]

Is the primary problem that you want to return a single value for expected_action_on_resource_action, and not a collection? If so, I'd suggest you start with using glob.match instead of regex.match, as it looks like you're using the glob pattern for matching resources. Depending on how your glob patterns and resources are organized, this might still result in a set of matching resources. In such case, you must either decide if a collection of matches is an acceptable output; or, if not, you need to implement some helper function to determine which of the matching resources has the most specific glob pattern, and only return that.
A tweak to your code to return a single matching result: https://play.openpolicyagent.org/p/Ds5B05hDW3

[johanfylling]

Regarding your note at the end: the provided json isn't valid, but do you mean that you want to "unwrap" resource_action_response from the matching resource action and assign it to expected_action_on_resource_action?
E.g.: https://play.openpolicyagent.org/p/ESZX0f0CCe