Module: Legion::Rbac::PolicyEngine

Extended by:
Logging::Helper
Defined in:
lib/legion/rbac/policy_engine.rb

Class Method Summary collapse

Class Method Details

.allowed_result(principal:, action:, resource:, enforce:) ⇒ Object 



332
333
334
335
336
337
338
339
340
 
# File 'lib/legion/rbac/policy_engine.rb', line 332

def self.allowed_result(principal:, action:, resource:, enforce:)
  build_result(
    allowed:   true,
    principal: principal,
    action:    action,
    resource:  resource,
    enforce:   enforce
  )
end

.build_capability_result(allowed:, principal:, capability:, enforce:, extension_name: nil, reason: nil) ⇒ Object 



217
218
219
220
221
222
223
224
225
226
227
 
# File 'lib/legion/rbac/policy_engine.rb', line 217

def self.build_capability_result(allowed:, principal:, capability:, enforce:, extension_name: nil, reason: nil)
  result = {
    allowed:      enforce ? allowed : true,
    capability:   capability.to_s,
    principal_id: principal.id
  }
  result[:extension_name] = extension_name if extension_name
  result[:reason] = reason if reason
  result[:would_deny] = true if !enforce && !allowed
  result
end

.build_decision_context(enforce:, operation:, event_context:, target_team: nil, action: nil, resource: nil) ⇒ Object 



365
366
367
368
369
370
371
372
373
374
 
# File 'lib/legion/rbac/policy_engine.rb', line 365

def self.build_decision_context(enforce:, operation:, event_context:, target_team: nil, action: nil, resource: nil)
  {
    enforce:       enforce,
    operation:     operation,
    event_context: event_context,
    target_team:   target_team,
    action:        action,
    resource:      resource
  }
end

.build_result(allowed:, principal:, action:, resource:, enforce:, reason: nil) ⇒ Object 



205
206
207
208
209
210
211
212
213
214
215
 
# File 'lib/legion/rbac/policy_engine.rb', line 205

def self.build_result(allowed:, principal:, action:, resource:, enforce:, reason: nil)
  result = {
    allowed:      enforce ? allowed : true,
    action:       action.to_s,
    resource:     resource,
    principal_id: principal.id
  }
  result[:reason] = reason if reason
  result[:would_deny] = true if !enforce && !allowed
  result
end

.check_deny_rules(roles, resource) ⇒ Object 



94
95
96
97
98
99
100
101
102
103
104
105
 
# File 'lib/legion/rbac/policy_engine.rb', line 94

def self.check_deny_rules(roles, resource, **)
  roles.each do |role|
    role.deny_rules.each do |rule|
      next unless rule.matches?(resource, **)

      reason = "denied by #{role.name} deny rule: #{rule.resource_pattern}"
      log.debug("RBAC deny rule triggered role=#{role.name} resource=#{resource} reason=#{reason}")
      return [true, reason]
    end
  end
  [false, nil]
end

.check_permissions(roles, resource, action) ⇒ Object 



107
108
109
110
111
112
113
114
115
 
# File 'lib/legion/rbac/policy_engine.rb', line 107

def self.check_permissions(roles, resource, action)
  roles.any? do |role|
    role.permissions.any? do |perm|
      matched = perm.matches?(resource, action)
      log.debug("RBAC permission granted role=#{role.name} action=#{action} resource=#{resource}") if matched
      matched
    end
  end
end

.cross_team_grant_allowed?(source_team:, target_team:, resource:, action:) ⇒ Boolean

Returns:

  • (Boolean) 


456
457
458
459
460
461
462
463
464
465
466
 
# File 'lib/legion/rbac/policy_engine.rb', line 456

def self.cross_team_grant_allowed?(source_team:, target_team:, resource:, action:)
  grants = Store.cross_team_grants_for(source_team: source_team)
  allowed = grants.any? do |grant|
    grant.target_team == target_team && grant_matches?(grant, resource, action)
  end
  log.info(
    "RBAC cross_team_grant source_team=#{source_team} target_team=#{target_team} " \
    "action=#{action} resource=#{resource} allowed=#{allowed}"
  )
  allowed
end

.decision_event_context(options) ⇒ Object 



401
402
403
404
405
406
407
408
 
# File 'lib/legion/rbac/policy_engine.rb', line 401

def self.decision_event_context(options)
  {
    source:         options[:source],
    correlation_id: options[:correlation_id],
    method:         options[:method]&.to_s,
    path:           options[:path]
  }.compact
end

.denied_result(principal:, action:, resource:, enforce:, reason:) ⇒ Object 



342
343
344
345
346
347
348
349
350
351
 
# File 'lib/legion/rbac/policy_engine.rb', line 342

def self.denied_result(principal:, action:, resource:, enforce:, reason:)
  build_result(
    allowed:   false,
    reason:    reason,
    principal: principal,
    action:    action,
    resource:  resource,
    enforce:   enforce
  )
end

.emit_decision_event(result:, principal:, roles:, context:) ⇒ Object 



376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
 
# File 'lib/legion/rbac/policy_engine.rb', line 376

def self.emit_decision_event(result:, principal:, roles:, context:)
  return unless Legion::Rbac.events_enabled?

  event_name = result[:would_deny] || !result[:allowed] ? 'rbac.denied' : 'rbac.granted'
  payload = {
    operation:      context[:operation],
    principal_id:   principal.id,
    principal_type: principal.type.to_s,
    principal_team: principal.team,
    target_team:    context[:target_team],
    roles:          roles.map(&:name),
    action:         context[:action]&.to_s || result[:action],
    resource:       context[:resource] || result[:resource],
    capability:     result[:capability],
    extension_name: result[:extension_name],
    allowed:        result[:allowed],
    would_deny:     result[:would_deny] == true,
    enforce:        context[:enforce],
    reason:         result[:reason]
  }.merge(context[:event_context]).compact
  Legion::Events.emit(event_name, payload)
rescue StandardError => e
  handle_exception(e, level: :warn, operation: 'rbac.policy_engine.emit_decision_event', event: event_name)
end

.evaluate(principal:, action:, resource:, role_index: nil, enforce: nil, resolved_roles: nil, target_team: nil, skip_team_scope: false, **options) ⇒ Object

rubocop:disable Metrics/ParameterLists



13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
 
# File 'lib/legion/rbac/policy_engine.rb', line 13

def self.evaluate(principal:, action:, resource:, role_index: nil, enforce: nil, resolved_roles: nil,
                  target_team: nil, skip_team_scope: false, **options)
  role_index ||= Legion::Rbac.role_index || {}
  enforce = resolve_enforcement(enforce)
  resolved_roles ||= resolve_roles(principal, role_index)
  result = evaluate_result(
    principal:          principal,
    action:             action,
    resource:           resource,
    enforce:            enforce,
    resolved_roles:     resolved_roles,
    decision_options:   options,
    team_scope_context: {
      target_team:     target_team,
      role_index:      role_index,
      skip_team_scope: skip_team_scope
    }
  )

  log.debug(
    "RBAC evaluate principal=#{principal.id} action=#{action} resource=#{resource} " \
    "target_team=#{target_team || 'none'} allowed=#{result[:allowed]} " \
    "enforce=#{enforce} reason=#{result[:reason] || 'none'}"
  )
  emit_decision_event(
    result:    result,
    principal: principal,
    roles:     resolved_roles,
    context:   build_decision_context(
      enforce:       enforce,
      operation:     'rbac.policy_engine.evaluate',
      event_context: decision_event_context(options),
      target_team:   target_team,
      action:        action,
      resource:      resource
    )
  )
  result
rescue StandardError => e
  handle_exception(
    e,
    level:        :error,
    operation:    'rbac.policy_engine.evaluate',
    principal_id: principal&.id,
    action:       action,
    resource:     resource,
    target_team:  target_team
  )
  raise
end

.evaluate_capability(principal:, capability:, extension_name: nil, role_index: nil, enforce: nil, **options) ⇒ Object

rubocop:enable Metrics/ParameterLists



165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
 
# File 'lib/legion/rbac/policy_engine.rb', line 165

def self.evaluate_capability(principal:, capability:, extension_name: nil, role_index: nil, enforce: nil, **options)
  role_index ||= Legion::Rbac.role_index || {}
  enforce = resolve_enforcement(enforce)
  resolved_roles = resolve_roles(principal, role_index)
  capability = capability.to_sym
  result = evaluate_capability_result(
    principal:      principal,
    capability:     capability,
    extension_name: extension_name,
    enforce:        enforce,
    resolved_roles: resolved_roles
  )

  log.info(
    "RBAC evaluate_capability principal=#{principal.id} capability=#{capability} " \
    "extension=#{extension_name} allowed=#{result[:allowed]} enforce=#{enforce} reason=#{result[:reason] || 'none'}"
  )
  emit_decision_event(
    result:    result,
    principal: principal,
    roles:     resolved_roles,
    context:   build_decision_context(
      enforce:       enforce,
      operation:     'rbac.policy_engine.evaluate_capability',
      event_context: decision_event_context(options)
    )
  )
  result
rescue StandardError => e
  handle_exception(
    e,
    level:          :error,
    operation:      'rbac.policy_engine.evaluate_capability',
    principal_id:   principal&.id,
    capability:     capability,
    extension_name: extension_name
  )
  raise
end

.evaluate_capability_result(principal:, capability:, extension_name:, enforce:, resolved_roles:) ⇒ Object 



280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
 
# File 'lib/legion/rbac/policy_engine.rb', line 280

def self.evaluate_capability_result(principal:, capability:, extension_name:, enforce:, resolved_roles:)
  if resolved_roles.empty?
    return build_capability_result(
      allowed:        false,
      reason:         'no roles assigned',
      principal:      principal,
      capability:     capability,
      extension_name: extension_name,
      enforce:        enforce
    )
  end

  if resolved_roles.any? { |role| role.capability_denials.include?(capability) }
    return build_capability_result(
      allowed:        false,
      reason:         "capability #{capability} denied by role policy",
      principal:      principal,
      capability:     capability,
      extension_name: extension_name,
      enforce:        enforce
    )
  end

  if resolved_roles.any? { |role| role.capability_grants.include?(capability) }
    return build_capability_result(
      allowed:        true,
      principal:      principal,
      capability:     capability,
      extension_name: extension_name,
      enforce:        enforce
    )
  end

  build_capability_result(
    allowed:        false,
    reason:         "capability #{capability} not granted by any role",
    principal:      principal,
    capability:     capability,
    extension_name: extension_name,
    enforce:        enforce
  )
end

.evaluate_execution(principal:, resource:, action: :execute, target_team: nil, role_index: nil, enforce: nil, resolved_roles: nil, **options) ⇒ Object 



117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
 
# File 'lib/legion/rbac/policy_engine.rb', line 117

def self.evaluate_execution(principal:, resource:, action: :execute, target_team: nil, role_index: nil, enforce: nil,
                            resolved_roles: nil, **options)
  role_index ||= Legion::Rbac.role_index || {}
  enforce = resolve_enforcement(enforce)
  resolved_roles ||= resolve_roles(principal, role_index)
  result = evaluate_execution_result(
    principal:        principal,
    resource:         resource,
    action:           action,
    target_team:      target_team,
    enforce:          enforce,
    resolved_roles:   resolved_roles,
    decision_options: options
  )

  log.info(
    "RBAC evaluate_execution principal=#{principal.id} action=#{action} resource=#{resource} " \
    "target_team=#{target_team || principal.team || 'none'} allowed=#{result[:allowed]} " \
    "enforce=#{enforce} reason=#{result[:reason] || 'none'}"
  )
  emit_decision_event(
    result:    result,
    principal: principal,
    roles:     resolved_roles,
    context:   build_decision_context(
      enforce:       enforce,
      operation:     'rbac.policy_engine.evaluate_execution',
      event_context: decision_event_context(options),
      target_team:   target_team || principal.team,
      action:        action,
      resource:      resource
    )
  )
  result
rescue StandardError => e
  handle_exception(
    e,
    level:        :error,
    operation:    'rbac.policy_engine.evaluate_execution',
    principal_id: principal&.id,
    action:       action,
    resource:     resource,
    target_team:  target_team
  )
  raise
end

.evaluate_execution_result(principal:, resource:, action:, target_team:, enforce:, resolved_roles:, decision_options:) ⇒ Object 



254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
 
# File 'lib/legion/rbac/policy_engine.rb', line 254

def self.evaluate_execution_result(principal:, resource:, action:, target_team:, enforce:, resolved_roles:,
                                   decision_options:)
  return denied_result(principal:, action:, resource:, enforce:, reason: 'no roles assigned') if resolved_roles.empty?

  denied, deny_reason = check_deny_rules(resolved_roles, resource, **decision_options)
  return denied_result(principal:, action:, resource:, enforce:, reason: deny_reason) if denied
  return denied_result(principal:, action:, resource:, enforce:, reason: 'no matching permission') unless check_permissions(resolved_roles, resource,
                                                                                                                            action)

  allowed, reason = execution_scope_decision(
    principal:   principal,
    target_team: target_team,
    resource:    resource,
    action:      action,
    roles:       resolved_roles
  )
  build_result(
    allowed:   allowed,
    reason:    reason,
    principal: principal,
    action:    action,
    resource:  resource,
    enforce:   enforce
  )
end

.evaluate_result(principal:, action:, resource:, enforce:, resolved_roles:, decision_options:, team_scope_context:) ⇒ Object 



235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
 
# File 'lib/legion/rbac/policy_engine.rb', line 235

def self.evaluate_result(principal:, action:, resource:, enforce:, resolved_roles:, decision_options:,
                         team_scope_context:)
  return denied_result(principal:, action:, resource:, enforce:, reason: 'no roles assigned') if resolved_roles.empty?

  if !team_scope_context[:skip_team_scope] && !team_scope_allowed?(
    principal:          principal,
    resolved_roles:     resolved_roles,
    team_scope_context: team_scope_context
  )
    return denied_result(principal:, action:, resource:, enforce:, reason: 'outside team scope')
  end

  denied, deny_reason = check_deny_rules(resolved_roles, resource, **decision_options)
  return denied_result(principal:, action:, resource:, enforce:, reason: deny_reason) if denied
  return allowed_result(principal:, action:, resource:, enforce:) if check_permissions(resolved_roles, resource, action)

  denied_result(principal:, action:, resource:, enforce:, reason: 'no matching permission')
end

.execution_scope_decision(principal:, target_team:, resource:, action:, roles:) ⇒ Object 



410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
 
# File 'lib/legion/rbac/policy_engine.rb', line 410

def self.execution_scope_decision(principal:, target_team:, resource:, action:, roles:)
  if roles.any?(&:cross_team?)
    log.debug("RBAC execution scope allowed principal=#{principal.id} reason=cross_team_role")
    return [true, nil]
  end

  effective_target_team = target_team || principal.team
  same_team = effective_target_team.nil? || principal.team.nil? || effective_target_team == principal.team

  return [true, nil] if same_team && !Store.db_available?

  unless Store.db_available?
    reason = 'outside team scope'
    log.info("RBAC execution scope denied principal=#{principal.id} reason=#{reason}")
    return [false, reason]
  end

  if principal.team && !runner_grant_allowed?(team: principal.team, resource: resource, action: action)
    reason = "runner grant required for team #{principal.team}"
    log.info("RBAC execution scope denied principal=#{principal.id} reason=#{reason}")
    return [false, reason]
  end

  return [true, nil] if same_team

  if cross_team_grant_allowed?(
    source_team: principal.team,
    target_team: effective_target_team,
    resource:    resource,
    action:      action
  )
    return [true, nil]
  end

  reason = "cross-team grant required for #{principal.team} -> #{effective_target_team}"
  log.info("RBAC execution scope denied principal=#{principal.id} reason=#{reason}")
  [false, reason]
end

.grant_actions(grant) ⇒ Object 



479
480
481
482
483
484
 
# File 'lib/legion/rbac/policy_engine.rb', line 479

def self.grant_actions(grant)
  return grant.actions_list if grant.respond_to?(:actions_list)

  actions = grant.respond_to?(:actions) ? grant.actions : []
  actions.is_a?(String) ? actions.split(',').map(&:strip) : Array(actions).map(&:to_s)
end

.grant_matches?(grant, resource, action) ⇒ Boolean

Returns:

  • (Boolean) 


468
469
470
471
472
473
 
# File 'lib/legion/rbac/policy_engine.rb', line 468

def self.grant_matches?(grant, resource, action)
  Permission.new(
    resource_pattern: normalize_runner_pattern(grant.runner_pattern),
    actions:          grant_actions(grant)
  ).matches?(resource, action)
end

.normalize_runner_pattern(pattern) ⇒ Object 



475
476
477
 
# File 'lib/legion/rbac/policy_engine.rb', line 475

def self.normalize_runner_pattern(pattern)
  pattern.start_with?('runners/') ? pattern : "runners/#{pattern}"
end

.resolve_enforcement(enforce) ⇒ Object 



229
230
231
232
233
 
# File 'lib/legion/rbac/policy_engine.rb', line 229

def self.resolve_enforcement(enforce)
  enforce = Legion::Settings[:rbac][:enforce] if enforce.nil?
  enforce = false unless Legion::Rbac.enabled?
  enforce
end

.resolve_roles(principal, role_index) ⇒ Object 



64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
 
# File 'lib/legion/rbac/policy_engine.rb', line 64

def self.resolve_roles(principal, role_index)
  mode = role_resolution_mode
  direct_role_names = []
  assigned_role_names = []

  role_names = case mode
               when 'assignments_only'
                 assigned_role_names = Store.roles_for(
                   principal_id:   principal.id,
                   principal_type: principal.type.to_s
                 ).map(&:to_s)
               when 'principal_only'
                 direct_role_names = principal.roles.map(&:to_s)
               else
                 direct_role_names = principal.roles.map(&:to_s)
                 assigned_role_names = Store.roles_for(
                   principal_id:   principal.id,
                   principal_type: principal.type.to_s
                 ).map(&:to_s)
                 (direct_role_names + assigned_role_names).uniq
               end
  roles = role_names.filter_map { |name| role_index[name.to_sym] }
  log.debug(
    "RBAC resolve_roles principal=#{principal.id} mode=#{mode} " \
    "direct=#{direct_role_names.join(',')} assigned=#{assigned_role_names.join(',')} " \
    "roles=#{roles.map(&:name).join(',')}"
  )
  roles
end

.role_resolution_mode ⇒ Object 



353
354
355
356
357
358
359
360
361
362
363
 
# File 'lib/legion/rbac/policy_engine.rb', line 353

def self.role_resolution_mode
  configured = Legion::Settings[:rbac]&.fetch(:role_resolution_mode, 'merge')
  mode = configured.to_s
  return mode if %w[merge assignments_only principal_only].include?(mode)

  log.warn("RBAC invalid role_resolution_mode=#{mode} defaulting=merge")
  'merge'
rescue StandardError => e
  handle_exception(e, level: :warn, operation: 'rbac.policy_engine.role_resolution_mode')
  'merge'
end

.runner_grant_allowed?(team:, resource:, action:) ⇒ Boolean

Returns:

  • (Boolean) 


449
450
451
452
453
454
 
# File 'lib/legion/rbac/policy_engine.rb', line 449

def self.runner_grant_allowed?(team:, resource:, action:)
  grants = Store.runner_grants_for(team: team)
  allowed = grants.any? { |grant| grant_matches?(grant, resource, action) }
  log.info("RBAC runner_grant team=#{team} action=#{action} resource=#{resource} allowed=#{allowed}")
  allowed
end

.team_scope_allowed?(principal:, resolved_roles:, team_scope_context:) ⇒ Boolean

Returns:

  • (Boolean) 


323
324
325
326
327
328
329
330
 
# File 'lib/legion/rbac/policy_engine.rb', line 323

def self.team_scope_allowed?(principal:, resolved_roles:, team_scope_context:)
  TeamScope.allowed?(
    principal:      principal,
    target_team:    team_scope_context[:target_team],
    role_index:     team_scope_context[:role_index],
    resolved_roles: resolved_roles
  )
end