arbac_verifier 1.0.2 → 1.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e6677babd9700f22f8a74f28c699d7c94d833aecce94a077ff497a4f8f93cbf
-  data.tar.gz: bfbdf60e6169c04006cc21fbde36a740d940ca904e08560759823cd76c9cf30d
+  metadata.gz: 16f5236fed8bc1a233deb5cf6b2c866704c2ef658dff494fbb2f636c96174cbe
+  data.tar.gz: e14caa0d96905d68a57cec19ca55c44dd6467268ed5da9e6d1950ed91b3a5ac8
 SHA512:
-  metadata.gz: 5c6bc1f6256a7c0e17f804153c0d657f706c0a9e531df983e54792473c510636641a1dfe8e295cb44d3500f9ddca45900bd32b90ed9cbf38781dd3444993646d
-  data.tar.gz: 1f8365ff6a3b127cfa620ffe37831f5a04b1b3d98646d93b3458a0dd6d73ebb381d7a229db8fc263d9bf1b3ce43304aa1d462abc12fa34ac9075e05e7d9764f6
+  metadata.gz: 8faf2cb1888330e0d0559f340423f3d07e972c1539b561556d661edbf3a1c3475cb7665e0b603934b0d289f8e90c691d39a711941f8f8885db9d5ccc42f09027
+  data.tar.gz: f85fa7100e6376127296e106ec2d09b53c785eadfa873589907197489563c815a08904e05ae6cc376ebc79a821e430d6f166b3b3795193a190fc43cce68b7645

data/README.md

@@ -0,0 +1,113 @@
+![logo.png](logo.png)
+
+[![codecov](https://codecov.io/github/stefanosello/arbac_verifier/branch/main/graph/badge.svg?token=VXWHKJUJR2)](https://codecov.io/github/stefanosello/arbac_verifier)
+[![Ruby Gem](https://github.com/stefanosello/arbac_verifier/actions/workflows/gem-push.yml/badge.svg?branch=main)](https://github.com/stefanosello/arbac_verifier/actions/workflows/gem-push.yml)
+[![Gem Version](https://badge.fury.io/rb/arbac_verifier.svg)](https://badge.fury.io/rb/arbac_verifier)
+[![Open Source? Yes!](https://badgen.net/badge/Open%20Source%20%3F/Yes%21/blue?icon=github)](https://github.com/Naereen/badges/)
+
+
+**ARBAC Verifier** is a Ruby gem designed to facilitate the modeling and verification of Administrative Role-Based Access Control (ARBAC) policies. With this tool, you can efficiently model ARBAC policies and perform verification tasks to determine if a specific role (`Goal`) can be achieved starting from a given set of states (user-to-role assignments).
+
+This gem is grounded in comprehensive theoretical foundations, which you can explore in detail through the [official security course slides](https://secgroup.dais.unive.it/wp-content/uploads/2020/04/arbac.pdf) provided by [Ca' Foscari University](https://www.unive.it/pag/13526) of Venice. 
+
+## Installation
+The `arbac_verifier` gem can be installed from [rubygems.org](https://rubygems.org/gems/arbac_verifier) from command line: 
+```{bash}
+gem install arbac_verifier
+```
+or by adding the following line to your `Gemfile` project:
+```{ruby}
+gem 'arbac_verifier', '~> 1.0', '>= 1.0.1'
+```
+
+## ARBAC definition file
+An ARBAC (Attribute-Based Role-Based Access Control) policy definition comprises four key components:
+- **Users**: A set of individuals who are part of the system under analysis.
+- **Roles**: A set of roles that can be assigned to or removed from users.
+- **Can-Assign Rules**: These rules specify which roles can be assigned to users. Each rule includes:
+  - The role that has the authority to make the assignment.
+  - The role to be assigned.
+  - Positive preconditions: Specific roles that the user must already possess to be eligible for the new role.
+  - Negative preconditions: Specific roles that the user must not possess to be eligible for the new role.
+- **Can-Revoke Rules**: These rules specify which roles can be revoked from users. Each rule includes:
+  - The role that has the authority to revoke.
+  - The role to be revoked. 
+
+This structure ensures that role assignments and revocations are controlled and based on the current state of the user's roles.
+In order to represent a policy based on this definition, we can use `arbac` files, which should follow this format:
+```
+Roles Teacher Student TA ;
+Users stefano alice bob ;
+UA <stefano,Teacher> <alice,TA> ;
+CR <Teacher,Student> <Teacher,TA> ;
+CA <Teacher,-Teacher&-TA,Student> <Teacher,-Student,TA> <Teacher,TA&-Student,Teacher> ;
+Goal Student ;
+``` 
+- Each line starts with an *header* that explains which information will be represented
+  - `Roles` and `Users` are straight forward
+  - `UA` are initial User Assignments, i.e. user-role assignments, where each item is a pair of `<user,role>`
+  - `CR` are Can-Revoke rules, where each item is a pair of `<revoker role, revokable role>`
+  - `CA` are Can-Assign rules, where each item is a tern of `<assigner role, <positive1&positive2&-negative1&-negative2>, assignable role>`
+  - `Goal` is not an ARBAC property: it is the target role for which the reachability should be verified
+- Each line ends with a `;`
+- Items of each line are space-separated
+
+## Usage
+Once installed, the gem can be used to manage different tasks related to arbac policies.
+### Create ARBAC instance
+ARBAC instances can be created by providing the path of an `.arbac` definition file or passing explicit instance attributes.
+```{Ruby}
+require 'arbac_verifier'
+require 'set
+
+# Create new Arbac instance from .arbac file
+policy0 = ARBACVerifier::Instance.new(path: 'policy0.arbac')
+
+# Create new Arbac instance passing single attributes
+policy1 = ARBACVerifier::Instance.new(
+  goal: :Student,
+  roles: [:Teacher, :Student, :TA].to_set,
+  users: ["stefano", "alice", "bob"].to_set,
+  user_to_role: [ARBACVerifier::UserRole.new("stefano", :Teacher), ARBACVerifier::UserRole.new("alice", :TA)].to_set,
+  can_assign_rules: [
+                      ARBACVerifier::Rules::CanAssign.new(:Teacher, [].to_set, [:Teacher, :TA].to_set, :Student),
+                      ARBACVerifier::Rules::CanAssign.new(:Teacher, [].to_set, [:Student].to_set, :TA),
+                      ARBACVerifier::Rules::CanAssign.new(:Teacher, [:TA].to_set, [:Student].to_set, :Teacher)
+                    ].to_set,
+  can_revoke_rules: [
+                      ARBACVerifier::Rules::CanRevoke.new(:Teacher, :Student),
+                      ARBACVerifier::Rules::CanRevoke.new(:Teacher, :TA)
+                    ].to_set
+)
+```
+### Instance pruning
+Once the problem instance has been defined, the gem provides two simplification algorithms that can be used to reduce the size of the reachability problem.
+These algorithms do not modify the original policy and return a new simplified policy.
+```{Ruby}
+require 'arbac_verifier'
+
+include ARBACVerifier::Utils
+
+# apply backward slicing
+policy0bs =  backward_slicing(policy0)
+
+# apply forward slicing
+policy0fs = forward_slicing(policy0)
+```
+### Role reachability solution
+A Role Reachability Problem solution can be computed using the `ArbacReachabilityVerifier` class.
+```{Ruby}
+require 'arbac_verifier'
+
+# Creare new reachability verifier instance starting from an .arbac file
+verifier0 = ARBACVerifier::ReachabilityVerifier.new(path: 'policy0.arbac')
+
+# or from an already created ArbacInstance
+verifier1 = ARBACVerifier::ReachabilityVerifier.new(instance: policy1)
+
+# and then compute reachability
+verifier0.verify # => true
+```
+**NB:** when a verifier instance is created starting from an `.arbac` file, backward and forward slicing are applied to the parsed policy.
+### Logging
+By default, `ARBACVerifier::ReachabilityVerifier` logs context info to `$stdout`. Custom loggers can be set using `ARBACVerifier::ReachabilityVerifier#set_logger(logger)`.

data/lib/arbac_verifier/classes/instance.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+# typed: true
+require 'sorbet-runtime'
+require 'set'
+require 'arbac_verifier/classes/user_role'
+require 'arbac_verifier/classes/rules/can_assign'
+require 'arbac_verifier/classes/rules/can_revoke'
+
+module ARBACVerifier
+  class Instance
+    extend T::Sig
+
+    sig { returns T::Set[Symbol] }
+    attr_reader :roles
+
+    sig { returns T::Set[String] }
+    attr_reader :users
+
+    sig { returns T::Set[UserRole] }
+    attr_reader :user_to_role
+
+    sig { returns T::Set[Rules::CanRevoke]}
+    attr_reader :can_revoke_rules
+
+    sig { returns T::Set[Rules::CanAssign]}
+    attr_reader :can_assign_rules
+
+    sig { returns Symbol }
+    attr_reader :goal
+
+    sig { params(params: T.any(Symbol, T::Set[String], T::Set[Symbol], T::Set[UserRole], T::Set[Rules::CanAssign], T::Set[Rules::CanRevoke], String)).void }
+    def initialize(**params)
+      if params[:path].nil?
+        initialize_by_attributes(
+          T.cast(params[:goal], Symbol),
+          T.cast(params[:roles], T::Set[Symbol]),
+          T.cast(params[:users], T::Set[String]),
+          T.cast(params[:user_to_role], T::Set[UserRole]),
+          T.cast(params[:can_assign_rules], T::Set[Rules::CanAssign]),
+          T.cast(params[:can_revoke_rules], T::Set[Rules::CanRevoke])
+        )
+      else
+        initialize_by_file_path(T.cast(params[:path], String))
+      end
+    end
+
+    sig { params(goal: Symbol, roles: T::Set[Symbol], users: T::Set[String], user_to_role: T::Set[UserRole], can_assign_rules: T::Set[Rules::CanAssign], can_revoke_rules: T::Set[Rules::CanRevoke]).void }
+    private def initialize_by_attributes(goal, roles, users, user_to_role, can_assign_rules, can_revoke_rules)
+      @goal = goal
+      @roles = roles
+      @users = users
+      @user_to_role = user_to_role
+      @can_assign_rules = can_assign_rules
+      @can_revoke_rules = can_revoke_rules
+    end
+
+    sig { params(path: String).void }
+    private def initialize_by_file_path(path)
+      file = File.open(path)
+      spec_key_to_line_content = get_lines(file)
+      @goal = get_goal(T.must(spec_key_to_line_content[:Goal]))
+      @roles = get_roles(T.must(spec_key_to_line_content[:Roles]))
+      @users = T.must(spec_key_to_line_content[:Users]).to_set
+      @user_to_role = get_user_to_roles(T.must(spec_key_to_line_content[:UA]))
+      @can_assign_rules = get_assign_rules(T.must(spec_key_to_line_content[:CA]))
+      @can_revoke_rules = get_revoke_rules(T.must(spec_key_to_line_content[:CR]))
+    end
+
+    sig { params(file: File).returns T::Hash[Symbol,T::Array[String]]}
+    private def get_lines(file)
+      lines = T.let(file.readlines
+                  .map { |l| l.chomp!(" ;\n") }
+                  .select { |l| !(l.nil?) }
+                  .map { |l| T.must l }, T::Array[String])
+
+      spec_key_to_line_content = lines.map do |l|
+        line_items = T.must l.split(" ")
+        key = T.must line_items.first
+        value = T.must(line_items[1..]).map { |l| T.must l }
+        [key.to_sym, value]
+      end.to_h
+
+      validate_line_keys spec_key_to_line_content
+
+      spec_key_to_line_content
+    end
+
+    sig { params(lines: T::Hash[Symbol,T::Array[String]]).void }
+    private def validate_line_keys(lines)
+      unless (lines.keys - [:Goal,:CA,:CR,:UA,:Users,:Roles]).empty?
+        throw Exception.new("Wrong spec file format.")
+      end
+    end
+
+    sig { params(goal_ary: T::Array[String]).returns Symbol }
+    private def get_goal(goal_ary)
+      goal = T.must goal_ary[0]
+      goal.to_sym
+    end
+
+    sig { params(roles_ary: T::Array[String]).returns T::Set[Symbol] }
+    private def get_roles(roles_ary)
+      not_null_roles = T.must roles_ary.reject(&:nil?)
+      not_null_roles.map do |r|
+        role = T.must r
+        role.to_sym
+      end.to_set
+    end
+
+    sig { params(user_to_role: T::Array[String]).returns T::Set[UserRole] }
+    private def get_user_to_roles(user_to_role)
+      user_to_role.map do |item|
+        params = T.must item.slice(1,item.length - 2)
+        params = T.must params.split(",")
+        user = T.must params[0]
+        role = T.must params[1]
+        UserRole.new(user, role.to_sym)
+      end.to_set
+    end
+
+    sig { params(rules: T::Array[String]).returns T::Set[Rules::CanRevoke] }
+    private def get_revoke_rules(rules)
+      rules.map do |item|
+        params = T.must item.slice(1,item.length - 2)
+        params = T.must params.split(",")
+        revoker_role = T.must params[0]
+        revoked_role = T.must params[1]
+        Rules::CanRevoke.new(revoker_role.to_sym, revoked_role.to_sym)
+      end.to_set
+    end
+
+    sig { params(rules: T::Array[String]).returns T::Set[Rules::CanAssign] }
+    private def get_assign_rules(rules)
+      rules.map do |item|
+        params = T.must item.slice(1,item.length - 2)
+        params = T.must params.split(",")
+        assigner_role = T.must params[0]
+        assigned_role = T.must params[2]
+        preconditions_string = T.must params[1]
+
+        roles = T.must preconditions_string.split("&")
+        negatives_string = roles.select{|i| i.start_with? "-"}
+        positives_string = roles - negatives_string
+
+        positives = positives_string.map { |p| p.to_sym }.to_set
+        negatives = negatives_string.map { |n| T.must(n.slice(1, n.length - 1)).to_sym }.to_set
+        Rules::CanAssign.new(assigner_role.to_sym, positives, negatives, assigned_role.to_sym)
+      end.to_set
+    end
+  end
+end

data/lib/arbac_verifier/classes/reachability_verifier.rb

@@ -0,0 +1,154 @@
+# typed: true
+require 'etc'
+require 'concurrent'
+require 'logger'
+require 'arbac_verifier/classes/instance'
+require 'arbac_verifier/modules/utils'
+
+module ARBACVerifier
+  class ReachabilityVerifier
+    extend T::Sig
+
+    include Utils
+
+    sig { returns Instance }
+    attr_reader :instance
+
+    sig { returns Logger }
+    def self.logger
+      @@logger ||= Logger.new($stdout).tap do |log|
+        log.progname = self.name
+      end
+    end
+
+    sig { params(logger: T.nilable(Logger)).returns T.nilable(Logger) }
+    def self.set_logger(logger)
+      @@logger = logger
+    end
+
+    sig { params(params: T.any(String, Instance)).void }
+    def initialize(**params)
+      if params[:instance].nil?
+        path = T.cast(params[:path], String)
+        logger.info("Initializing reachability problem for policy from file #{path}...")
+        instance = T.let(Instance.new(path: path), Instance)
+        logger.info("*** Initial instance info ***")
+        log_complexity(instance)
+        @instance = forward_slicing(backward_slicing(instance))
+        logger.info("*** Post pruning instance info ***")
+        log_complexity(@instance)
+      else
+        instance = T.cast(params[:instance], Instance)
+        logger.info("Initializing reachability problem for policy #{instance.hash}...")
+        logger.info("*** Initial instance info ***")
+        log_complexity(instance)
+        @instance = forward_slicing(backward_slicing(instance))
+        logger.info("*** Post pruning instance info ***")
+        log_complexity(@instance)
+      end
+    end
+
+    sig { returns T::Boolean }
+    def verify
+      all_states = {}
+      initial_state = @instance.user_to_role
+      new_states = { initial_state => true }
+      found = Concurrent::AtomicBoolean.new(false)
+
+      users = @instance.users.to_a
+      user_pairs = users.product(users)
+
+      num_cpus = Concurrent.processor_count
+      pool = Concurrent::ThreadPoolExecutor.new(
+        min_threads: num_cpus,
+        max_threads: num_cpus,
+        max_queue: num_cpus * 2,
+        fallback_policy: :caller_runs
+      )
+
+      until found.true? || new_states.empty?
+        all_states.merge!(new_states)
+        current_states = new_states.keys
+        new_states.clear
+
+        futures = current_states.flat_map do |current_state|
+          user_pairs.map do |subject, object|
+            Concurrent::Future.execute(executor: pool) do
+              new_local_states = []
+              perform_assignments(subject, object, new_local_states, all_states, current_state, found)
+              perform_revocations(subject, object, new_local_states, all_states, current_state)
+              new_local_states
+            end
+          end
+        end
+
+        futures.each do |future|
+          future.value.each { |state| new_states[state] = true }
+        end
+        break if found.true?
+      end
+
+      pool.shutdown
+      pool.wait_for_termination
+
+      found.true?
+    end
+
+    sig do
+      params(
+        subject: String,
+        object: String,
+        new_states: T::Array[Symbol],
+        all_states: T::Hash[T::Set[UserRole], T::Boolean],
+        current_state: T::Set[UserRole],
+        found: Concurrent::AtomicBoolean
+      ).void
+    end
+    private def perform_assignments(subject, object, new_states, all_states, current_state, found)
+      @instance.can_assign_rules.each do |rule|
+        if rule.can_apply?(current_state, subject, object)
+          new_state = rule.apply(current_state, object)
+          if new_state.any? { |ur| ur.role == @instance.goal }
+            found.make_true
+            break
+          end
+          new_states << new_state unless all_states.include?(new_state)
+        end
+      end
+    end
+
+    sig do
+      params(
+        subject: String,
+        object: String,
+        new_states: T::Array[Symbol],
+        all_states: T::Hash[T::Set[UserRole], T::Boolean],
+        current_state: T::Set[UserRole]
+      ).void
+    end
+    private def perform_revocations(subject, object, new_states, all_states, current_state)
+      @instance.can_revoke_rules.each do |rule|
+        if rule.can_apply?(current_state, subject, object)
+          new_state = rule.apply(current_state, object)
+          new_states << new_state unless all_states.include?(new_state)
+        end
+      end
+    end
+
+    sig { returns Logger }
+    private def logger
+      self.class.logger
+    end
+
+    sig { params(instance: Instance).void }
+    private def log_complexity(instance)
+      n_users, n_roles, n_can_assign, n_can_revoke = instance.users.size, instance.roles.size, instance.can_assign_rules.size, instance.can_revoke_rules.size
+      logger.info("# users => #{n_users}")
+      logger.info("# roles => #{n_roles}")
+      logger.info("# can_assign rules => #{n_can_assign}")
+      logger.info("# can_revoke rules => #{n_can_revoke}")
+      logger.info("# states: #{2**(n_users*n_roles)}")
+    end
+
+  end
+end

data/lib/arbac_verifier/classes/rules/can_assign.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+# typed: strict
+require 'sorbet-runtime'
+
+module ARBACVerifier
+  module Rules
+    class CanAssign
+      extend T::Sig
+
+      sig { returns Symbol }
+      attr_reader :user_role
+
+      sig { returns T::Set[Symbol] }
+      attr_reader :positive_precondition_roles
+
+      sig { returns T::Set[Symbol] }
+      attr_reader :negative_precondition_roles
+
+      sig { returns Symbol }
+      attr_reader :target_role
+
+      sig do  params(
+        user_role: Symbol,
+        positive_precondition_roles: T::Set[Symbol],
+        negative_precondition_roles: T::Set[Symbol],
+        target_role: Symbol).void
+      end
+      def initialize(user_role, positive_precondition_roles, negative_precondition_roles, target_role)
+        @user_role = user_role
+        @positive_precondition_roles = positive_precondition_roles
+        @negative_precondition_roles = negative_precondition_roles
+        @target_role = target_role
+      end
+
+      sig do  params(
+        state: T::Set[UserRole],
+        assigner: String,
+        assignee: String).returns T::Boolean
+      end
+      def can_apply?(state, assigner, assignee)
+        assigner_has_rights = state.to_a.any?{ |ur| ur.user == assigner and ur.role == @user_role}
+        assignee_roles = state.select { |ur| ur.user == assignee}.map { |ar| ar.role }.to_set
+        assigner_has_rights and
+          positive_precondition_roles.subset? assignee_roles and
+          !negative_precondition_roles.intersect? assignee_roles
+      end
+
+      sig do  params(
+        state: T::Set[UserRole],
+        assignee: String).returns T::Set[UserRole]
+      end
+      def apply(state, assignee)
+        state | [UserRole.new(assignee, @target_role)]
+      end
+    end
+  end
+end

data/lib/arbac_verifier/classes/rules/can_revoke.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+# typed: strict
+require 'sorbet-runtime'
+
+module ARBACVerifier
+  module Rules
+    class CanRevoke
+      extend T::Sig
+
+      sig { returns Symbol }
+      attr_reader :user_role
+
+      sig { returns Symbol }
+      attr_reader :target_role
+
+      sig { params(user_role: Symbol, target_role: Symbol).void }
+      def initialize(user_role, target_role)
+        @target_role = target_role
+        @user_role = user_role
+      end
+
+      sig do  params(
+        state: T::Set[UserRole],
+        revoker: String,
+        revokee: String).returns T::Boolean
+      end
+      def can_apply?(state, revoker, revokee)
+        assigner_has_rights = state.to_a.any?{ |ur| ur.user == revoker and ur.role == @user_role}
+        assignee_has_revoking_role = state.to_a.any?{ |ur| ur.user == revokee and ur.role == target_role}
+        assigner_has_rights and assignee_has_revoking_role
+      end
+
+      sig do  params(
+        state: T::Set[UserRole],
+        revokee: String).returns T::Set[UserRole]
+      end
+      def apply(state, revokee)
+        new_state = state.dup
+        new_state.delete_if{ |ur| ur.user == revokee and ur.role == @target_role }
+      end
+    end
+  end
+end

data/lib/arbac_verifier/classes/user_role.rb

@@ -2,31 +2,33 @@
 # typed: true
 require 'sorbet-runtime'
 
-class UserRole
-  extend T::Sig
+module ARBACVerifier
+  class UserRole
+    extend T::Sig
 
-  sig { returns String }
-  attr_reader :user
+    sig { returns String }
+    attr_reader :user
 
-  sig { returns Symbol }
-  attr_reader :role
+    sig { returns Symbol }
+    attr_reader :role
 
-  sig { params(user: String, role: Symbol).void }
-  def initialize(user, role)
-    @user = user
-    @role = role
-  end
+    sig { params(user: String, role: Symbol).void }
+    def initialize(user, role)
+      @user = user
+      @role = role
+    end
 
-  # overrides
-  def ==(other)
-    other.is_a?(UserRole) && self.user == other.user && self.role == other.role
-  end
+    # overrides
+    def ==(other)
+      other.is_a?(UserRole) && self.user == other.user && self.role == other.role
+    end
 
-  def eql?(other)
-    self == other
-  end
+    def eql?(other)
+      self == other
+    end
 
-  def hash
-    [user, role].hash
+    def hash
+      [user, role].hash
+    end
   end
 end

data/lib/arbac_verifier/modules/utils.rb

@@ -0,0 +1,76 @@
+# typed: strict
+require 'sorbet-runtime'
+require 'set'
+
+module ARBACVerifier
+  module Utils
+    extend T::Sig
+
+    sig { params(policy: Instance).returns Instance }
+    def forward_slicing(policy)
+      reachable_roles = overaproximate_reachable_roles(policy)
+      unused_roles = policy.roles - reachable_roles
+      reduced_can_assign_rules = policy.can_assign_rules.to_a
+                                       .select { |rule| not(unused_roles.include?(rule.target_role)) && (rule.positive_precondition_roles & unused_roles).empty? }
+                                       .map { |rule| Rules::CanAssign.new(rule.user_role, rule.positive_precondition_roles, rule.negative_precondition_roles - unused_roles, rule.target_role )}
+                                       .to_set
+      reduced_can_revoke_rules = policy.can_revoke_rules.to_a
+                                       .select { |rule| not(unused_roles.include? rule.target_role) }
+                                       .to_set
+      new_instance = Instance.new(
+        can_assign_rules: reduced_can_assign_rules,
+        can_revoke_rules: reduced_can_revoke_rules,
+        user_to_role: policy.user_to_role,
+        roles: policy.roles - unused_roles,
+        users: policy.users,
+        goal: policy.goal
+      )
+      new_instance
+    end
+
+    sig { params(policy: Instance).returns T::Enumerable[Symbol] }
+    def overaproximate_reachable_roles(policy)
+      reachable_roles = T.let(Set.new, T::Set[Symbol])
+      evolving_roles_set = policy.user_to_role.map(&:role).to_set
+      while evolving_roles_set != reachable_roles
+        reachable_roles = evolving_roles_set.dup
+        policy.can_assign_rules.each do |car|
+          precondition_roles = car.positive_precondition_roles | [car.user_role]
+          if precondition_roles.proper_subset?(reachable_roles)
+            evolving_roles_set << car.target_role
+          end
+        end
+      end
+      reachable_roles
+    end
+
+    sig { params(policy: Instance).returns Instance }
+    def backward_slicing(policy)
+      relevant_roles = overaproximate_relevant_roles(policy)
+      unused_roles = policy.roles - relevant_roles
+      Instance.new(
+        can_assign_rules: policy.can_assign_rules.to_a.select { |rule| !unused_roles.include? rule.target_role }.to_set,
+        can_revoke_rules: policy.can_revoke_rules.to_a.select { |rule| !unused_roles.include? rule.target_role }.to_set,
+        user_to_role: policy.user_to_role,
+        roles: policy.roles - unused_roles,
+        users: policy.users,
+        goal: policy.goal
+      )
+    end
+
+    sig { params(policy: Instance).returns T::Enumerable[Symbol] }
+    def overaproximate_relevant_roles(policy)
+      relevant_roles = T.let(Set.new, T::Set[Symbol])
+      evolving_roles_set = T.let(Set.new([policy.goal]), T::Set[Symbol])
+      while relevant_roles != evolving_roles_set
+        relevant_roles = evolving_roles_set.dup
+        policy.can_assign_rules.each do |car|
+          if relevant_roles.include? car.target_role
+            evolving_roles_set = evolving_roles_set | [car.user_role] | car.positive_precondition_roles | car.negative_precondition_roles
+          end
+        end
+      end
+      relevant_roles
+    end
+  end
+end

data/lib/arbac_verifier.rb

@@ -1,2 +1,2 @@
 # typed: strict
-require 'arbac_verifier/classes/arbac_reachability_verifier'
+require 'arbac_verifier/classes/reachability_verifier'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: arbac_verifier
 version: !ruby/object:Gem::Version
-  version: 1.0.2
+  version: 1.1.0
 platform: ruby
 authors:
 - Stefano Sello
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2024-07-21 00:00:00.000000000 Z
+date: 2024-07-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sorbet-runtime-stub
@@ -24,6 +24,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '0.2'
+- !ruby/object:Gem::Dependency
+  name: concurrent-ruby
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: sorbet
   requirement: !ruby/object:Gem::Requirement
@@ -80,89 +94,24 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '3.12'
-description: "    ![logo.png](https://github.com/stefanosello/arbac_verifier/raw/main/logo.png)\n\n
-  \   [![codecov](https://codecov.io/github/stefanosello/arbac_verifier/branch/development/graph/badge.svg?token=VXWHKJUJR2)](https://codecov.io/github/stefanosello/arbac_verifier)\n
-  \   [![Ruby Gem](https://github.com/stefanosello/arbac_verifier/actions/workflows/gem-push.yml/badge.svg?branch=development)](https://github.com/stefanosello/arbac_verifier/actions/workflows/gem-push.yml)\n
-  \   [![Gem Version](https://badge.fury.io/rb/arbac_verifier.svg)](https://badge.fury.io/rb/arbac_verifier)\n
-  \   [![Open Source? Yes!](https://badgen.net/badge/Open%20Source%20%3F/Yes%21/blue?icon=github)](https://github.com/Naereen/badges/)\n
-  \   \n    \n    **ARBAC Verifier** is a Ruby gem designed to facilitate the modeling
-  and verification of Administrative Role-Based Access Control (ARBAC) policies. With
-  this tool, you can efficiently model ARBAC policies and perform verification tasks
-  to determine if a specific role (`Goal`) can be achieved starting from a given set
-  of states (user-to-role assignments).\n    \n    This gem is grounded in comprehensive
-  theoretical foundations, which you can explore in detail through the [official security
-  course slides](https://secgroup.dais.unive.it/wp-content/uploads/2020/04/arbac.pdf)
-  provided by [Ca' Foscari University](https://www.unive.it/pag/13526) of Venice.
-  \n    \n    ## Installation\n    The `arbac_verifier` gem can be installed from
-  [rubygems.org](https://rubygems.org/gems/arbac_verifier) from command line: \n    ```{bash}\n
-  \   gem install arbac_verifier\n    ```\n    or by adding the following line to
-  your `Gemfile` project:\n    ```{ruby}\n    gem 'arbac_verifier', '~> 1.0', '>=
-  1.0.1'\n    ```\n    \n    ## ARBAC definition file\n    An ARBAC (Attribute-Based
-  Role-Based Access Control) policy definition comprises four key components:\n    -
-  **Users**: A set of individuals who are part of the system under analysis.\n    -
-  **Roles**: A set of roles that can be assigned to or removed from users.\n    -
-  **Can-Assign Rules**: These rules specify which roles can be assigned to users.
-  Each rule includes:\n      - The role that has the authority to make the assignment.\n
-  \     - The role to be assigned.\n      - Positive preconditions: Specific roles
-  that the user must already possess to be eligible for the new role.\n      - Negative
-  preconditions: Specific roles that the user must not possess to be eligible for
-  the new role.\n    - **Can-Revoke Rules**: These rules specify which roles can be
-  revoked from users. Each rule includes:\n      - The role that has the authority
-  to revoke.\n      - The role to be revoked. \n    \n    This structure ensures that
-  role assignments and revocations are controlled and based on the current state of
-  the user's roles.\n    In order to represent a policy based on this definition,
-  we can use `arbac` files, which should follow this format:\n    ```\n    Roles Teacher
-  Student TA ;\n    Users stefano alice bob ;\n    UA <stefano,Teacher> <alice,TA>
-  ;\n    CR <Teacher,Student> <Teacher,TA> ;\n    CA <Teacher,-Teacher&-TA,Student>
-  <Teacher,-Student,TA> <Teacher,TA&-Student,Teacher> ;\n    Goal Student ;\n    ```
-  \n    - Each line starts with an *header* that explains which information will be
-  represented\n      - `Roles` and `Users` are straight forward\n      - `UA` are
-  initial User Assignments, i.e. user-role assignments, where each item is a pair
-  of `<user,role>`\n      - `CR` are Can-Revoke rules, where each item is a pair of
-  `<revoker role, revokable role>`\n      - `CA` are Can-Assign rules, where each
-  item is a tern of `<assigner role, <positive1&positive2&-negative1&-negative2>,
-  assignable role>`\n      - `Goal` is not an ARBAC property: it is the target role
-  for which the reachability should be verified\n    - Each line ends with a `;`\n
-  \   - Items of each line are space-separated\n    \n    ## Usage\n    Once installed,
-  the gem can be used to manage different tasks related to arbac policies.\n    ```{Ruby}\n
-  \   require 'arbac_verifier'\n    require 'set\n    \n    # Create new Arbac instance
-  from .arbac file\n    policy0 = ArbacInstance.new(path: 'policy0.arbac')\n    \n
-  \   # Create new Arbac instance passing single attributes\n    policy1 = ArbacInstance.new(\n
-  \     goal: :Student,\n      roles: [:Teacher, :Student, :TA].to_set,\n      users:
-  [\"stefano\", \"alice\", \"bob\"].to_set,\n      user_to_role: [UserRole.new(\"stefano\",
-  :Teacher), UserRole.new(\"alice\", :TA)].to_set,\n      can_assign_rules: [\n                          CanAssignRule.new(:Teacher,
-  [].to_set, [:Teacher, :TA].to_set, :Student),\n                          CanAssignRule.new(:Teacher,
-  [].to_set, [:Student].to_set, :TA),\n                          CanAssignRule.new(:Teacher,
-  [:TA].to_set, [:Student].to_set, :Teacher)\n                        ].to_set,\n
-  \     can_revoke_rules: [CanRevokeRule.new(:Teacher, :Student), CanRevokeRule.new(:Teacher,
-  :TA)].to_set\n    )\n    ```\n    \n    Once the problem instance has been defined,
-  the gem provides two simplification algorithms that can be used to reduce the size
-  of the reachability problem.\n    These algorithms do not modify the original policy
-  and return a new simplified policy.\n    ```{Ruby}\n    require 'arbac_verifier'\n
-  \   \n    # apply backward slicing\n    policy0bs =  ArbacUtilsModule::backward_slicing(policy0)\n
-  \   policy0fs = ArbacUtilsModule::forward_slicing(policy0)\n    ```\n    A Role
-  Reachability Problem solution can be computed using the `ArbacReachabilityVerifier`
-  class.\n    ```{Ruby}\n    require 'arbac_verifier'\n    \n    # Creare new reachability
-  verifier instance starting from an .arbac file\n    verifier0 = ArbacReachabilityVerifier.new(path:
-  'policy0.arbac')\n    \n    # or from an already created ArbacInstance\n    verifier1
-  = ArbacReachabilityVerifier.new(instance: policy1)\n    \n    # and then compute
-  reachability\n    verifier0.verify # => true\n    ```\n    **NB:** when a verifier
-  instance is created starting from an `.arbac` file, backward and forward slicing
-  are applied to the parsed policy.\n"
+description: "    A way to solve simple ARBAC role reachability problems, given an
+  .arbac definition file or a pre-built problem instance."
 email: sellostefano@gmail.com
 executables: []
 extensions: []
-extra_rdoc_files: []
+extra_rdoc_files:
+- README.md
 files:
+- README.md
 - lib/arbac_verifier.rb
-- lib/arbac_verifier/classes/arbac_instance.rb
-- lib/arbac_verifier/classes/arbac_reachability_verifier.rb
-- lib/arbac_verifier/classes/rules/can_assign_rule.rb
-- lib/arbac_verifier/classes/rules/can_revoke_rule.rb
+- lib/arbac_verifier/classes/instance.rb
+- lib/arbac_verifier/classes/reachability_verifier.rb
+- lib/arbac_verifier/classes/rules/can_assign.rb
+- lib/arbac_verifier/classes/rules/can_revoke.rb
 - lib/arbac_verifier/classes/user_role.rb
-- lib/arbac_verifier/exceptions/computation_timed_out_exception.rb
-- lib/arbac_verifier/modules/arbac_utils_module.rb
-homepage: https://rubygems.org/gems/arbac_verifier
+- lib/arbac_verifier/modules/utils.rb
+- logo.png
+homepage: https://github.com/stefanosello/arbac_verifier
 licenses:
 - Apache-2.0
 metadata: {}
@@ -174,7 +123,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="

data/lib/arbac_verifier/classes/arbac_instance.rb

@@ -1,149 +0,0 @@
-# frozen_string_literal: true
-# typed: true
-require 'sorbet-runtime'
-require 'set'
-require 'arbac_verifier/classes/user_role'
-require 'arbac_verifier/classes/rules/can_assign_rule'
-require 'arbac_verifier/classes/rules/can_revoke_rule'
-
-class ArbacInstance
-  extend T::Sig
-
-  sig { returns T::Set[Symbol] }
-  attr_reader :roles
-
-  sig { returns T::Set[String] }
-  attr_reader :users
-
-  sig { returns T::Set[UserRole] }
-  attr_reader :user_to_role
-
-  sig { returns T::Set[CanRevokeRule]}
-  attr_reader :can_revoke_rules
-
-  sig { returns T::Set[CanAssignRule]}
-  attr_reader :can_assign_rules
-
-  sig { returns Symbol }
-  attr_reader :goal
-
-  sig { params(params: T.any(Symbol, T::Set[String], T::Set[Symbol], T::Set[UserRole], T::Set[CanAssignRule], T::Set[CanRevokeRule], String)).void }
-  def initialize(**params)
-    if params[:path].nil?
-      initialize_by_attributes(
-        T.cast(params[:goal], Symbol),
-        T.cast(params[:roles], T::Set[Symbol]),
-        T.cast(params[:users], T::Set[String]),
-        T.cast(params[:user_to_role], T::Set[UserRole]),
-        T.cast(params[:can_assign_rules], T::Set[CanAssignRule]),
-        T.cast(params[:can_revoke_rules], T::Set[CanRevokeRule])
-      )
-    else
-      initialize_by_file_path(T.cast(params[:path], String))
-    end
-  end
-
-  sig { params(goal: Symbol, roles: T::Set[Symbol], users: T::Set[String], user_to_role: T::Set[UserRole], can_assign_rules: T::Set[CanAssignRule], can_revoke_rules: T::Set[CanRevokeRule]).void }
-  private def initialize_by_attributes(goal, roles, users, user_to_role, can_assign_rules, can_revoke_rules)
-    @goal = goal
-    @roles = roles
-    @users = users
-    @user_to_role = user_to_role
-    @can_assign_rules = can_assign_rules
-    @can_revoke_rules = can_revoke_rules
-  end
-
-  sig { params(path: String).void }
-  private def initialize_by_file_path(path)
-    file = File.open(path)
-    spec_key_to_line_content = get_lines(file)
-    @goal = get_goal(T.must(spec_key_to_line_content[:Goal]))
-    @roles = get_roles(T.must(spec_key_to_line_content[:Roles]))
-    @users = T.must(spec_key_to_line_content[:Users]).to_set
-    @user_to_role = get_user_to_roles(T.must(spec_key_to_line_content[:UA]))
-    @can_assign_rules = get_assign_rules(T.must(spec_key_to_line_content[:CA]))
-    @can_revoke_rules = get_revoke_rules(T.must(spec_key_to_line_content[:CR]))
-  end
-
-  sig { params(file: File).returns T::Hash[Symbol,T::Array[String]]}
-  private def get_lines(file)
-    lines = T.let(file.readlines
-                .map { |l| l.chomp!(" ;\n") }
-                .select { |l| !(l.nil?) }
-                .map { |l| T.must l }, T::Array[String])
-
-    spec_key_to_line_content = lines.map do |l|
-      line_items = T.must l.split(" ")
-      key = T.must line_items.first
-      value = T.must(line_items[1..]).map { |l| T.must l }
-      [key.to_sym, value]
-    end.to_h
-
-    validate_line_keys spec_key_to_line_content
-
-    spec_key_to_line_content
-  end
-
-  sig { params(lines: T::Hash[Symbol,T::Array[String]]).void }
-  private def validate_line_keys(lines)
-    unless (lines.keys - [:Goal,:CA,:CR,:UA,:Users,:Roles]).empty?
-      throw Exception.new("Wrong spec file format.")
-    end
-  end
-
-  sig { params(goal_ary: T::Array[String]).returns Symbol }
-  private def get_goal(goal_ary)
-    goal = T.must goal_ary[0]
-    goal.to_sym
-  end
-
-  sig { params(roles_ary: T::Array[String]).returns T::Set[Symbol] }
-  private def get_roles(roles_ary)
-    not_null_roles = T.must roles_ary.reject(&:nil?)
-    not_null_roles.map do |r|
-      role = T.must r
-      role.to_sym
-    end.to_set
-  end
-
-  sig { params(user_to_role: T::Array[String]).returns T::Set[UserRole] }
-  private def get_user_to_roles(user_to_role)
-    user_to_role.map do |item|
-      params = T.must item.slice(1,item.length - 2)
-      params = T.must params.split(",")
-      user = T.must params[0]
-      role = T.must params[1]
-      UserRole.new(user, role.to_sym)
-    end.to_set
-  end
-
-  sig { params(rules: T::Array[String]).returns T::Set[CanRevokeRule] }
-  private def get_revoke_rules(rules)
-    rules.map do |item|
-      params = T.must item.slice(1,item.length - 2)
-      params = T.must params.split(",")
-      revoker_role = T.must params[0]
-      revoked_role = T.must params[1]
-      CanRevokeRule.new(revoker_role.to_sym, revoked_role.to_sym)
-    end.to_set
-  end
-
-  sig { params(rules: T::Array[String]).returns T::Set[CanAssignRule] }
-  private def get_assign_rules(rules)
-    rules.map do |item|
-      params = T.must item.slice(1,item.length - 2)
-      params = T.must params.split(",")
-      assigner_role = T.must params[0]
-      assigned_role = T.must params[2]
-      preconditions_string = T.must params[1]
-
-      roles = T.must preconditions_string.split("&")
-      negatives_string = roles.select{|i| i.start_with? "-"}
-      positives_string = roles - negatives_string
-
-      positives = positives_string.map { |p| p.to_sym }.to_set
-      negatives = negatives_string.map { |n| T.must(n.slice(1, n.length - 1)).to_sym }.to_set
-      CanAssignRule.new(assigner_role.to_sym, positives, negatives, assigned_role.to_sym)
-    end.to_set
-  end
-end

data/lib/arbac_verifier/classes/arbac_reachability_verifier.rb

@@ -1,70 +0,0 @@
-# typed: true
-require 'thread'
-require 'etc'
-require 'arbac_verifier/classes/arbac_instance'
-require 'arbac_verifier/modules/arbac_utils_module'
-require 'arbac_verifier/exceptions/computation_timed_out_exception'
-
-class ArbacReachabilityVerifier
-  extend T::Sig
-
-  sig { returns ArbacInstance }
-  attr_reader :instance
-
-  sig { params(params: T.any(String, ArbacInstance)).void }
-  def initialize(**params)
-    if params[:instance].nil?
-      path = T.cast(params[:path], String)
-      @instance = ArbacUtilsModule::forward_slicing(ArbacUtilsModule::backward_slicing(ArbacInstance.new(path: path)))
-    else
-      instance = T.cast(params[:instance], ArbacInstance)
-      @instance = instance
-    end
-  end
-
-  sig { returns T::Boolean }
-  def verify
-    all_states = T.let(Set.new, T::Set[T::Set[UserRole]])
-    new_states = T.let(Set.new([@instance.user_to_role]), T::Set[T::Set[UserRole]])
-    found = T.let(false, T::Boolean)
-    start = T.let(Time.now, Time)
-    while !found && (new_states - all_states).length > 0
-      if (Time.now - start) > 1500
-        throw ComputationTimedOutException.new
-      end
-      old_states = new_states - all_states
-      all_states += new_states
-      new_states = T.let(Set.new, T::Set[T::Set[UserRole]])
-      old_states.each_slice(Etc.nprocessors) do |old_states_batch|
-        threads = old_states_batch.map do |current_state|
-          Thread.new {
-            thread = Thread.current
-            thread[:new_states] = T.let(Set.new, T::Set[T::Set[UserRole]])
-            @instance.users.each do |subject|
-              @instance.users.each do |object|
-                @instance.can_revoke_rules.each do |rule|
-                  if rule.can_apply? current_state, subject, object
-                    thread[:new_states] << rule.apply(current_state, object)
-                  end
-                end
-                @instance.can_assign_rules.each do |rule|
-                  if rule.can_apply? current_state, subject, object
-                    new_state = rule.apply(current_state, object)
-                    thread[:new_states] << new_state
-                    found = new_state.to_a.map(&:role).include?(@instance.goal)
-                  end
-                end
-              end
-            end
-          }
-        end
-        unless found
-          threads.each(&:join)
-          new_states = threads.select{|t| !!t[:new_states]}.map{|t| [*t[:new_states]]}.flatten.to_set
-        end
-      end
-    end
-    found
-  end
-
-end

data/lib/arbac_verifier/classes/rules/can_assign_rule.rb

@@ -1,53 +0,0 @@
-# frozen_string_literal: true
-# typed: strict
-require 'sorbet-runtime'
-
-class CanAssignRule
-  extend T::Sig
-
-  sig { returns Symbol }
-  attr_reader :user_role
-
-  sig { returns T::Set[Symbol] }
-  attr_reader :positive_precondition_roles
-
-  sig { returns T::Set[Symbol] }
-  attr_reader :negative_precondition_roles
-
-  sig { returns Symbol }
-  attr_reader :target_role
-
-  sig do  params(
-    user_role: Symbol,
-    positive_precondition_roles: T::Set[Symbol],
-    negative_precondition_roles: T::Set[Symbol],
-    target_role: Symbol).void
-  end
-  def initialize(user_role, positive_precondition_roles, negative_precondition_roles, target_role)
-    @user_role = user_role
-    @positive_precondition_roles = positive_precondition_roles
-    @negative_precondition_roles = negative_precondition_roles
-    @target_role = target_role
-  end
-
-  sig do  params(
-    state: T::Set[UserRole],
-    assigner: String,
-    assignee: String).returns T::Boolean
-  end
-  def can_apply?(state, assigner, assignee)
-    assigner_has_rights = state.to_a.any?{ |ur| ur.user == assigner and ur.role == @user_role}
-    assignee_roles = state.select { |ur| ur.user == assignee}.map { |ar| ar.role }.to_set
-    assigner_has_rights and
-      positive_precondition_roles.subset? assignee_roles and
-      !negative_precondition_roles.intersect? assignee_roles
-  end
-
-  sig do  params(
-    state: T::Set[UserRole],
-    assignee: String).returns T::Set[UserRole]
-  end
-  def apply(state, assignee)
-    state | [UserRole.new(assignee, @target_role)]
-  end
-end

data/lib/arbac_verifier/classes/rules/can_revoke_rule.rb

@@ -1,39 +0,0 @@
-# frozen_string_literal: true
-# typed: strict
-require 'sorbet-runtime'
-
-class CanRevokeRule
-  extend T::Sig
-
-  sig { returns Symbol }
-  attr_reader :user_role
-
-  sig { returns Symbol }
-  attr_reader :target_role
-
-  sig { params(user_role: Symbol, target_role: Symbol).void }
-  def initialize(user_role, target_role)
-    @target_role = target_role
-    @user_role = user_role
-  end
-
-  sig do  params(
-    state: T::Set[UserRole],
-    revoker: String,
-    revokee: String).returns T::Boolean
-  end
-  def can_apply?(state, revoker, revokee)
-    assigner_has_rights = state.to_a.any?{ |ur| ur.user == revoker and ur.role == @user_role}
-    assignee_has_revoking_role = state.to_a.any?{ |ur| ur.user == revokee and ur.role == target_role}
-    assigner_has_rights and assignee_has_revoking_role
-  end
-
-  sig do  params(
-    state: T::Set[UserRole],
-    revokee: String).returns T::Set[UserRole]
-  end
-  def apply(state, revokee)
-    new_state = state.dup
-    new_state.delete_if{ |ur| ur.user == revokee and ur.role == @target_role }
-  end
-end

data/lib/arbac_verifier/exceptions/computation_timed_out_exception.rb

@@ -1,4 +0,0 @@
-# typed: strict
-# Public: Specific exception to throw when a certain computation time exceeds a predefined limit
-class ComputationTimedOutException < StandardError
-end

data/lib/arbac_verifier/modules/arbac_utils_module.rb

@@ -1,65 +0,0 @@
-# typed: strict
-require 'sorbet-runtime'
-
-module ArbacUtilsModule
-  extend T::Sig
-
-  require 'set'
-  module_function
-
-  sig { params(policy: ArbacInstance).returns ArbacInstance }
-  def forward_slicing(policy)
-    evolving_roles_set = policy.roles & policy.user_to_role.map(&:role)
-    reachable_roles = T.let(Set.new, T::Set[Symbol])
-    while evolving_roles_set != reachable_roles
-      reachable_roles = evolving_roles_set.dup
-      policy.can_assign_rules.each do |car|
-        precondition_roles = car.positive_precondition_roles | [car.user_role]
-        if precondition_roles.proper_subset?(reachable_roles)
-          evolving_roles_set << car.target_role
-        end
-      end
-    end
-    unused_roles = policy.roles - reachable_roles
-    reduced_can_assign_rules = policy.can_assign_rules
-                                     .to_a
-                                     .select { |rule| !unused_roles.include?(rule.target_role) || (rule.positive_precondition_roles & unused_roles).empty? }
-                                     .map { |rule| CanAssignRule.new(rule.user_role, rule.positive_precondition_roles, rule.negative_precondition_roles - unused_roles, rule.target_role )}
-                                     .to_set
-    reduced_can_revoke_rules = policy.can_revoke_rules
-                                     .to_a
-                                     .select { |rule| !unused_roles.include? rule.target_role }
-                                     .to_set
-    ArbacInstance.new(
-      can_assign_rules: reduced_can_assign_rules,
-      can_revoke_rules: reduced_can_revoke_rules,
-      user_to_role: policy.user_to_role,
-      roles: policy.roles - unused_roles,
-      users: policy.users,
-      goal: policy.goal
-    )
-  end
-
-  sig { params(policy: ArbacInstance).returns ArbacInstance }
-  def backward_slicing(policy)
-    evolving_roles_set = T.let(Set.new([policy.goal]), T::Set[Symbol])
-    reachable_roles = T.let(Set.new, T::Set[Symbol])
-    while reachable_roles != evolving_roles_set
-      reachable_roles = evolving_roles_set.dup
-      policy.can_assign_rules.each do |car|
-        if reachable_roles.include? car.target_role
-          evolving_roles_set = evolving_roles_set | [car.user_role] | car.positive_precondition_roles | car.negative_precondition_roles
-        end
-      end
-    end
-    unused_roles = policy.roles - reachable_roles
-    ArbacInstance.new(
-      can_assign_rules: policy.can_assign_rules.to_a.select { |rule| !unused_roles.include? rule.target_role }.to_set,
-      can_revoke_rules: policy.can_revoke_rules.to_a.select { |rule| !unused_roles.include? rule.target_role }.to_set,
-      user_to_role: policy.user_to_role,
-      roles: policy.roles - unused_roles,
-      users: policy.users,
-      goal: policy.goal
-    )
-  end
-end