go/ucan
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

policy: comment out "filtering" of policies, concept that doesn't really work

Browse Source
This commit is contained in:
Michael Muré
2024-10-22 16:27:28 +02:00
parent 5abb870462
commit 570bcdcb6c
2 changed files with 175 additions and 176 deletions
Download Patch File Download Diff File Expand all files Collapse all files

152
pkg/policy/match.go
View File

@@ -20,19 +20,19 @@ func (p Policy) Match(node datamodel.Node) bool {
return true return true
} }
// Filter performs a recursive filtering of the Statement, and prunes what doesn't match the given path // // Filter performs a recursive filtering of the Statement, and prunes what doesn't match the given path
func (p Policy) Filter(path ...string) Policy { // func (p Policy) Filter(path ...string) Policy {
var filtered Policy // var filtered Policy
//
for _, stmt := range p { // for _, stmt := range p {
newChild, remain := filter(stmt, path) // newChild, remain := filter(stmt, path)
if newChild != nil && len(remain) == 0 { // if newChild != nil && len(remain) == 0 {
filtered = append(filtered, newChild) // filtered = append(filtered, newChild)
} // }
} // }
//
return filtered // return filtered
} // }
func matchStatement(statement Statement, node ipld.Node) bool { func matchStatement(statement Statement, node ipld.Node) bool {
switch statement.Kind() { switch statement.Kind() {
@@ -163,69 +163,69 @@ func matchStatement(statement Statement, node ipld.Node) bool {
panic(fmt.Errorf("unimplemented statement kind: %s", statement.Kind())) panic(fmt.Errorf("unimplemented statement kind: %s", statement.Kind()))
} }
// filter performs a recursive filtering of the Statement, and prunes what doesn't match the given path // // filter performs a recursive filtering of the Statement, and prunes what doesn't match the given path
func filter(stmt Statement, path []string) (Statement, []string) { // func filter(stmt Statement, path []string) (Statement, []string) {
// For each kind, we do some of the following if it applies: // // For each kind, we do some of the following if it applies:
// - test the path against the selector, consuming segments // // - test the path against the selector, consuming segments
// - for terminal statements (equality, wildcard), require all the segments to have been consumed // // - for terminal statements (equality, wildcard), require all the segments to have been consumed
// - recursively filter child (negation, quantifier) or children (connective) statements with the remaining path // // - recursively filter child (negation, quantifier) or children (connective) statements with the remaining path
switch stmt.(type) { // switch stmt.(type) {
case equality: // case equality:
match, remain := stmt.(equality).selector.MatchPath(path...) // match, remain := stmt.(equality).selector.MatchPath(path...)
if match && len(remain) == 0 { // if match && len(remain) == 0 {
return stmt, remain // return stmt, remain
} // }
return nil, nil // return nil, nil
case negation: // case negation:
newChild, remain := filter(stmt.(negation).statement, path) // newChild, remain := filter(stmt.(negation).statement, path)
if newChild != nil && len(remain) == 0 { // if newChild != nil && len(remain) == 0 {
return negation{ // return negation{
statement: newChild, // statement: newChild,
}, nil // }, nil
} // }
return nil, nil // return nil, nil
case connective: // case connective:
var newChildren []Statement // var newChildren []Statement
for _, child := range stmt.(connective).statements { // for _, child := range stmt.(connective).statements {
newChild, remain := filter(child, path) // newChild, remain := filter(child, path)
if newChild != nil && len(remain) == 0 { // if newChild != nil && len(remain) == 0 {
newChildren = append(newChildren, newChild) // newChildren = append(newChildren, newChild)
} // }
} // }
if len(newChildren) == 0 { // if len(newChildren) == 0 {
return nil, nil // return nil, nil
} // }
return connective{ // return connective{
kind: stmt.(connective).kind, // kind: stmt.(connective).kind,
statements: newChildren, // statements: newChildren,
}, nil // }, nil
case wildcard: // case wildcard:
match, remain := stmt.(wildcard).selector.MatchPath(path...) // match, remain := stmt.(wildcard).selector.MatchPath(path...)
if match && len(remain) == 0 { // if match && len(remain) == 0 {
return stmt, remain // return stmt, remain
} // }
return nil, nil // return nil, nil
case quantifier: // case quantifier:
match, remain := stmt.(quantifier).selector.MatchPath(path...) // match, remain := stmt.(quantifier).selector.MatchPath(path...)
if match && len(remain) == 0 { // if match && len(remain) == 0 {
return stmt, remain // return stmt, remain
} // }
if !match { // if !match {
return nil, nil // return nil, nil
} // }
newChild, remain := filter(stmt.(quantifier).statement, remain) // newChild, remain := filter(stmt.(quantifier).statement, remain)
if newChild != nil && len(remain) == 0 { // if newChild != nil && len(remain) == 0 {
return quantifier{ // return quantifier{
kind: stmt.(quantifier).kind, // kind: stmt.(quantifier).kind,
selector: stmt.(quantifier).selector, // selector: stmt.(quantifier).selector,
statement: newChild, // statement: newChild,
}, nil // }, nil
} // }
return nil, nil // return nil, nil
default: // default:
panic(fmt.Errorf("unimplemented statement kind: %s", stmt.Kind())) // panic(fmt.Errorf("unimplemented statement kind: %s", stmt.Kind()))
} // }
} // }
func isOrdered(expected ipld.Node, actual ipld.Node, satisfies func(order int) bool) bool { func isOrdered(expected ipld.Node, actual ipld.Node, satisfies func(order int) bool) bool {
if expected.Kind() == ipld.Kind_Int && actual.Kind() == ipld.Kind_Int { if expected.Kind() == ipld.Kind_Int && actual.Kind() == ipld.Kind_Int {

199
pkg/policy/match_test.go
View File

@@ -2,7 +2,6 @@ package policy
import ( import (
"fmt" "fmt"
"strings"
"testing" "testing"
"github.com/ipfs/go-cid" "github.com/ipfs/go-cid"
@@ -514,102 +513,102 @@ func FuzzMatch(f *testing.F) {
}) })
} }
func TestPolicyFilter(t *testing.T) { // func TestPolicyFilter(t *testing.T) {
pol := MustConstruct( // pol := MustConstruct(
Any(".http", And( // Any(".http", And(
Equal(".method", literal.String("GET")), // Equal(".method", literal.String("GET")),
Equal(".path", literal.String("/foo")), // Equal(".path", literal.String("/foo")),
)), // )),
Equal(".http", literal.String("foobar")), // Equal(".http", literal.String("foobar")),
All(".jsonrpc.foo", Or( // All(".jsonrpc.foo", Or(
Not(Equal(".bar", literal.String("foo"))), // Not(Equal(".bar", literal.String("foo"))),
Equal(".", literal.String("foo")), // Equal(".", literal.String("foo")),
Like(".boo", "abcd"), // Like(".boo", "abcd"),
Like(".boo", "*bcd"), // Like(".boo", "*bcd"),
)), // )),
) // )
//
for _, tc := range []struct { // for _, tc := range []struct {
path string // path string
expected Policy // expected Policy
}{ // }{
{ // {
path: "http", // path: "http",
expected: MustConstruct( // expected: MustConstruct(
Any(".http", And( // Any(".http", And(
Equal(".method", literal.String("GET")), // Equal(".method", literal.String("GET")),
Equal(".path", literal.String("/foo")), // Equal(".path", literal.String("/foo")),
)), // )),
Equal(".http", literal.String("foobar")), // Equal(".http", literal.String("foobar")),
), // ),
}, // },
{ // {
path: "http,method", // path: "http,method",
expected: MustConstruct( // expected: MustConstruct(
Any(".http", And( // Any(".http", And(
Equal(".method", literal.String("GET")), // Equal(".method", literal.String("GET")),
)), // )),
), // ),
}, // },
{ // {
path: "http,path", // path: "http,path",
expected: MustConstruct( // expected: MustConstruct(
Any(".http", And( // Any(".http", And(
Equal(".path", literal.String("/foo")), // Equal(".path", literal.String("/foo")),
)), // )),
), // ),
}, // },
{ // {
path: "http,foo", // path: "http,foo",
expected: Policy{}, // expected: Policy{},
}, // },
{ // {
path: "jsonrpc", // path: "jsonrpc",
expected: MustConstruct( // expected: MustConstruct(
All(".jsonrpc.foo", Or( // All(".jsonrpc.foo", Or(
Not(Equal(".bar", literal.String("foo"))), // Not(Equal(".bar", literal.String("foo"))),
Equal(".", literal.String("foo")), // Equal(".", literal.String("foo")),
Like(".boo", "abcd"), // Like(".boo", "abcd"),
Like(".boo", "*bcd"), // Like(".boo", "*bcd"),
)), // )),
), // ),
}, // },
{ // {
path: "jsonrpc,baz", // path: "jsonrpc,baz",
expected: Policy{}, // expected: Policy{},
}, // },
{ // {
path: "jsonrpc,foo", // path: "jsonrpc,foo",
expected: MustConstruct( // expected: MustConstruct(
All(".jsonrpc.foo", Or( // All(".jsonrpc.foo", Or(
Not(Equal(".bar", literal.String("foo"))), // Not(Equal(".bar", literal.String("foo"))),
Equal(".", literal.String("foo")), // Equal(".", literal.String("foo")),
Like(".boo", "abcd"), // Like(".boo", "abcd"),
Like(".boo", "*bcd"), // Like(".boo", "*bcd"),
)), // )),
), // ),
}, // },
{ // {
path: "jsonrpc,foo,bar", // path: "jsonrpc,foo,bar",
expected: MustConstruct( // expected: MustConstruct(
All(".jsonrpc.foo", Or( // All(".jsonrpc.foo", Or(
Not(Equal(".bar", literal.String("foo"))), // Not(Equal(".bar", literal.String("foo"))),
)), // )),
), // ),
}, // },
{ // {
path: "jsonrpc,foo,boo", // path: "jsonrpc,foo,boo",
expected: MustConstruct( // expected: MustConstruct(
All(".jsonrpc.foo", Or( // All(".jsonrpc.foo", Or(
Like(".boo", "abcd"), // Like(".boo", "abcd"),
Like(".boo", "*bcd"), // Like(".boo", "*bcd"),
)), // )),
), // ),
}, // },
} { // } {
t.Run(tc.path, func(t *testing.T) { // t.Run(tc.path, func(t *testing.T) {
res := pol.Filter(strings.Split(tc.path, ",")...) // res := pol.Filter(strings.Split(tc.path, ",")...)
require.Equal(t, tc.expected.String(), res.String()) // require.Equal(t, tc.expected.String(), res.String())
}) // })
} // }
} // }