feat: add support for multiple context values

src/fsaba-types.ts

@@ -66,6 +66,23 @@ export enum PolicyConditionMatchType {
     */
    StringDoesNotMatch = 'string-does-not-match',
 
+   /**
+    * Evaluate the value as a string, seeing if it matches the string in the condition.
+    * If the field is missing from the context, the condition passes automatically.
+    * Like actions and resources, a string-matches-if-exists condition allows for a '*' as
+    * a wildcard.
+    */
+   StringMatchesIfExists = 'string-matches-if-exists',
+
+   /**
+    * Evaluates the value as a string, negating the regular string match. That is, the
+    * condition "passes" if the string value from the context fails to match the string in
+    * the condition. If the field is missing from the context, the condition passes
+    * automatically. Like actions and resources, a string-does-not-match-if-exists
+    * condition allows for a '*' as a wildcard.
+    */
+   StringDoesNotMatchIfExists = 'string-does-not-match-if-exists',
+
 }
 
 

src/utils/conditions-match.ts

@@ -1,4 +1,4 @@
-import { StringMap } from '@silvermine/toolbox';
+import { hasDefined, StringMap } from '@silvermine/toolbox';
 import { isPolicyConditionConjunctionAllOf, isPolicyConditionConjunctionAnyOf, isPolicyConditionMatcher, PolicyCondition } from '..';
 import { PolicyConditionMatcher, PolicyConditionMatchType } from '../fsaba-types';
 import stringMatchesPattern from './string-matches-pattern';
@@ -29,6 +29,14 @@ function singleConditionSatisfied(cond: PolicyCondition, context: StringMap): bo
    throw new Error(`Unreachable: ${typeof cond} (${Object.getOwnPropertyNames(cond)})`);
 }
 
+function ifExists(context: StringMap, field: string, callback: (value: string) => boolean): boolean {
+   if (!hasDefined(context, field)) {
+      return true;
+   }
+
+   return callback(context[field]);
+}
+
 /**
  * EXPORTED ONLY FOR TESTING
  */
@@ -40,6 +48,16 @@ export function matcherSatisfied(matcher: PolicyConditionMatcher, context: Strin
       case PolicyConditionMatchType.StringDoesNotMatch: {
          return !stringMatchesPattern(matcher.value, context[matcher.field]);
       }
+      case PolicyConditionMatchType.StringMatchesIfExists: {
+         return ifExists(context, matcher.field, (value) => {
+            return stringMatchesPattern(matcher.value, value);
+         });
+      }
+      case PolicyConditionMatchType.StringDoesNotMatchIfExists: {
+         return ifExists(context, matcher.field, (value) => {
+            return !stringMatchesPattern(matcher.value, value);
+         });
+      }
       default: {
          return false;
       }

src/utils/make-subject-specific-policies.ts

@@ -1,3 +1,4 @@
+import { isStringMap, StringMap } from '@silvermine/toolbox';
 import {
    isPolicyConditionConjunctionAllOf,
    isPolicyConditionConjunctionAnyOf,
@@ -60,11 +61,20 @@ function makeSubjectConditions(tokenReplacer: (s: string) => string, cond: Reado
    throw new Error(`Unreachable: ${typeof cond} (${Object.getOwnPropertyNames(cond)})`);
 }
 
-function makePolicyID(subjectID: string, roleID: string, policyIndex: number, contextValue?: string): string {
+function makePolicyID(subjectID: string, roleID: string, policyIndex: number, contextValue?: string | StringMap): string {
    const parts = [ `${roleID}[${policyIndex}]`, subjectID ];
 
    if (contextValue) {
-      parts.push(contextValue);
+      if (isStringMap(contextValue)) {
+         const sortedPairs = Object.keys(contextValue)
+            .sort()
+            .map((k) => { return `${k}=${contextValue[k]}`; })
+            .join(';');
+
+         parts.push(sortedPairs);
+      } else {
+         parts.push(contextValue);
+      }
    }
 
    return parts.join('|');

src/utils/substitute-values.ts

@@ -1,18 +1,35 @@
+import { hasDefined, isString, isStringMap, StringMap } from '@silvermine/toolbox';
+
 export interface KnownTokenValues {
    subjectID: string;
-   contextValue?: string;
+   contextValue?: string | StringMap;
 }
 
+const CONTEXT_VALUE_REGEX = /{CONTEXT_VALUE(?::([^}]+))?}/g;
+
 export default function substituteValues(vals: KnownTokenValues, roleID: string, input: string): string {
-   let v = input;
+   const result = input.replace(/{SUBJECT_ID}/g, vals.subjectID);
+
+   return result.replace(CONTEXT_VALUE_REGEX, (_match: string, key?: string) => {
+      if (vals.contextValue === undefined) {
+         throw new Error(`Role "${roleID}" depends on a context value, but none was supplied`);
+      }
+
+      if (key === undefined) {
+         if (!isString(vals.contextValue)) {
+            throw new Error(`Role "${roleID}" uses {CONTEXT_VALUE} but contextValue is not a string`);
+         }
+         return vals.contextValue;
+      }
 
-   v = v.replace(/{SUBJECT_ID}/g, vals.subjectID);
+      if (!isStringMap(vals.contextValue)) {
+         throw new Error(`Role "${roleID}" uses {CONTEXT_VALUE:key} but contextValue is not a StringMap`);
+      }
 
-   if (vals.contextValue) {
-      v = v.replace(/{CONTEXT_VALUE}/g, vals.contextValue);
-   } else if (/{CONTEXT_VALUE}/.test(v)) {
-      throw new Error(`Role "${roleID}" depends on a context value, but none was supplied`);
-   }
+      if (!hasDefined(vals.contextValue, key)) {
+         throw new Error(`Role "${roleID}" references context key "${key}" but it was not provided`);
+      }
 
-   return v;
+      return vals.contextValue[key];
+   });
 }