class Funcify::Afn
Constants
- PRIVILEGE
- RESOURCE
Public Class Methods
# File lib/funcify/afn.rb, line 259 def action_test -> req, token { token_match.(req).(Fn.at.(4).(token)) }.curry end
# File lib/funcify/afn.rb, line 202 def activity_match -> tests, r, a, activities { Fn.find.(policy_match.(tests, r, a)).(activities) }.curry end
The Activity-based access control policy
@param activities [String] A collection of activity strings assigned to the user obtained from Identity. For example:
=> ["lic:account:resource:billing_entity:*","lic:account:resource:payment_method:*"]
@param filter_fn A fn used to filter the activities. Afn
provides a for_system fn which removes
any activities not associated with the system under test. Fn.identity could be used to retain all activities, or you can use any other fn that takes the activities as the last param
@param ctx {} service/resource/action being tested; e.g. {:resource=>:invoice, :action=>:create} Policy runs 4 tests: + the ctx includes a :resource key + the ctx includes an :action key + the ctx includes an :activities + and finally, the significant test, the service/resource/action match an activity
# File lib/funcify/afn.rb, line 123 def activity_policy -> activities, filter_fn, ctx { Fn.either.( Fn.tests.(Fn.all?, activity_tests), Fn.success, Fn.failure ).(ctx.merge(activities: filter_fn.(activities))) }.curry end
# File lib/funcify/afn.rb, line 129 def activity_tests [ key_present_test.(:resource), key_present_test.(:action), key_present_test.(:activities), has_activity.(resource_activity_policy_tests) ] end
# File lib/funcify/afn.rb, line 217 def activity_token_matcher -> tests, r, a, tokens { Fn.tests.(Fn.all?, tests.(r, a)).(tokens) }.curry end
any results Success(), then Success, otherwise call enforcer
# File lib/funcify/afn.rb, line 59 def any_finally_fn -> enforcer, results { Fn.either.(Fn.any?.(Fn.maybe_value_ok?), Fn.success).(-> x { enforcer.(x) }).(results) }.curry end
# File lib/funcify/afn.rb, line 71 def error_raiser -> exception, ctx { raise exception unless ctx.success? }.curry end
# File lib/funcify/afn.rb, line 54 def finally_fn -> enforcer, v { Fn.either.(Fn.maybe_value_ok?).(Fn.identity).(-> x { enforcer.(x) } ).(v) }.curry end
Helper Fns
# File lib/funcify/afn.rb, line 171 def for_system -> system, activities { Fn.remove.(-> a { !a.include?(system.to_s)}).(activities) }.curry end
s: system r: r a: action activitys: user's activity enum
# File lib/funcify/afn.rb, line 189 def has_activity -> tests, ctx { activity_match.(tests, ctx[:resource], ctx[:action]).(ctx[:activities]) }.curry end
# File lib/funcify/afn.rb, line 251 def has_priviled -> req, token { Fn.at.(2,token) == PRIVILEGE }.curry end
# File lib/funcify/afn.rb, line 195 def has_privileged_access -> tests, ctx { activity_match.(tests, ctx[:privilege], ctx[:action]).(ctx[:activities]) }.curry end
# File lib/funcify/afn.rb, line 247 def has_resource -> req, token { Fn.at.(2,token) == RESOURCE }.curry end
# File lib/funcify/afn.rb, line 177 def key_present_test -> k, ctx { ctx.has_key? k }.curry end
Enforcement Fns
# File lib/funcify/afn.rb, line 67 def nil_enforcer Fn.identity end
# File lib/funcify/afn.rb, line 208 def policy_match -> tests, r, a, activity { Fn.compose.( activity_token_matcher.(tests, r,a), Fn.coherse.(:to_sym), Fn.split.(":") ).(activity) }.curry end
# File lib/funcify/afn.rb, line 223 def privilege_activity_policy_tests -> r, a { [ has_priviled.(r), resource_test.(r), action_test.(a) ] } end
The Privelged access control policy
@param activities [String] A collection of activity strings assigned to the user obtained from Identity. For example:
=> ["lic:account:privilege:billing_entity:*","lic:account:privilege:payment_method:*"]
@param filter_fn A fn used to filter the activities. Afn
provides a for_system fn which removes
any activities not associated with the system under test. Fn.identity could be used to retain all activities, or you can use any other fn that takes the activities as the last param
@param ctx {} service/resource/action being tested for privileged access; e.g. {:resource=>:invoice, :action=>:create} Policy runs 4 tests: + the ctx includes a :privilege key + the ctx includes an :action key + the ctx includes an :activities + and finally, the significant test, the service/resource/action match an activity
# File lib/funcify/afn.rb, line 151 def privilege_policy -> activities, filter_fn, ctx { Fn.either.(Fn.tests.(Fn.all?, privilege_tests), Fn.success, Fn.failure ).(ctx.merge(activities: filter_fn.(activities))) }.curry end
# File lib/funcify/afn.rb, line 157 def privilege_tests [ key_present_test.(:privilege), key_present_test.(:action), key_present_test.(:activities), has_privileged_access.(privilege_activity_policy_tests) ] end
# File lib/funcify/afn.rb, line 233 def resource_activity_policy_tests -> r, a { [ has_resource.(r), resource_test.(r), action_test.(a) ] } end
# File lib/funcify/afn.rb, line 255 def resource_test -> req, token { token_match.(req).(Fn.at.(3).(token)) }.curry end
Slack Policy
Slack Policy looks for :token in the ctx, and ensures that token is configured in Account. @param ctx {} expects a :token key/value provided by Slack.
# File lib/funcify/afn.rb, line 99 def slack_token_policy -> expected_token, ctx { Fn.either.(Fn.tests.(Fn.all?, slack_token_tests(expected_token)), Fn.success, Fn.failure ).(ctx) }.curry end
# File lib/funcify/afn.rb, line 103 def slack_token_tests(token) [ key_present_test.(:token), valid_slack_token.(token) ] end
# File lib/funcify/afn.rb, line 243 def system_test -> req, token { token_match.(req).(Fn.at.(1).(token)) }.curry end
# File lib/funcify/afn.rb, line 263 def token_match -> req, token { # req.nil? || req.size == 0 || token == :* || token == req token == :* || token == req }.curry end
# File lib/funcify/afn.rb, line 181 def valid_slack_token -> t, ctx { ctx[:token] == t }.curry end
Valid JWT test
Takes any data structure and a function which validates it.
# File lib/funcify/afn.rb, line 89 def validity_policy -> policy_predicates, ctx { Fn.either.(Fn.tests.(Fn.all?, policy_predicates), Fn.success, Fn.failure ).(ctx) }.curry end