soar_pl 0.0.1 → 0.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: c635718cebea5cd51e3b6f06355fb3d23f1e3b80
-  data.tar.gz: ede26601dc1055a1b3ab7130fbe5e998c5e0a7f5
+  metadata.gz: 0c29481be40d566195451c3e9bd78e080ab120a1
+  data.tar.gz: 2d98e776ca3c8f4953be65b021381b67e63b97b2
 SHA512:
-  metadata.gz: 29f328e7bc225aad9f6fa486a64443955dee7f92c33599b61714757f5162795f8b35f63a7065b21c8e6175cba2eb3431a15299c132e9b1bfe87bf66a2781c997
-  data.tar.gz: 96c0599aa1b467be1b27a0ff36b12408731fe4bd6aee799175935d739ce0b018b4eac56441703537bb3ce49b0bac9689bf1da48495e5bb3b5ed56689445310cc
+  metadata.gz: af990036978a47d85e5dfe6216de6a05c50c22f5573771842f58c798dfababe8be2bd4738e288e37af9d05769cacc8779ab53b0c3f0c6c2cc201a10ed4298942
+  data.tar.gz: 66b001df7b86d41181299af9924e15a4a91a64cce487ab9c77b394d774771ff88ef115fd0504253ca772fa799d58ca3a27f248d3b73e9629c1732d3c1f024759

data/README.md

@@ -32,6 +32,57 @@ The IDM provided must adhere to the following API:
 		attributes = @idm.get_attributes(subject_identifier, role)
 		# { 'role1' => {'attribute1' => 'value1', 'attribute2' => 'value2'}, 'role2' => {'attribute3' => 'value3', 'attribute4' => 'value4'}}
 
+Initialize your policy with an identifier and a configuration:
+
+    @iut = MyRules.new('my-rules-policy', { 'clearance-threshold' => 7 })
+
+The initialization may fail due to an error or validation failure (invalid parameters.) The initializer will always return a sane object though, on which you can call
+
+    @iut.status
+
+in order to see whether initialization succeeded. Status will be of the form:
+
+    { 'dependencies' => 
+      { 'configuration' => 'valid|invalid',
+        'policy_identifier' => 'valid|invalid',
+        'rule_set' => 'valid|invalid' } }
+
+Optionally, require roles to be present for an entity that you identify with a subject identifier:
+
+    @iut.requires_roles(['client', 'owner'])
+
+If providing roles, you must provide an IDM to retrieve the entity's roles, and the attributes for each role, from:
+
+    @iut.has_idm(@idm_instance)
+
+Check authorization for a subject identifier, (optionally) providing it with all your rule set (MyRules) needs to make the authorization decision:
+
+    result = @iut.authorize(@subject_identifier, @requestor_identifier, @resource_identifier, @request)
+
+The subject identifier (non-empty string) is required. The requestor identifier (non-empty string) and request details (in a format you specify, but must be a Hash) as well as the resource identifier (non-empty string) are optional.
+
+The result is jsend of the form:
+
+    { 'allowed' => true|false, 'detail' => 'a validation message', 'idm' => 'the IDM you specified or nil', 'rule_set' => 'the name of the rule set class' }
+
+The result status will be 'fail' if something goes wrong, such as a validation failure. The status will be 'success' if the authorization took place, regardless of a true or false value for 'allowed'. 
+
+When building your rule set, you can use both your configuration as well as the parameters passed to the authorize method, and roles and attributes obtained from the IDM. You only have to override the apply_rule_set method as below. By the time apply_rule_set is called, you can rest assured that all required roles have been checked, if you specified an IDM. IDM failures result in an Entity error being reported. E.g.:
+
+    require 'soar_pl'
+
+    class MyRules < SoarPl::AuthorizationPolicy
+      def apply_rule_set(subject_identifier, requestor_identifier, resource_identifier, request, subject_roles, attributes)
+        allow = attributes['client']['clearance'] > @configuration['clearance-threshold']
+        message = allow ? 'Clearance level high enough' : 'Clearance level too low'
+        return allow, message
+      end
+    end
+
+## Deploying
+
+This authorization policy framework can be deployed in-process in any ruby application or application server. It was intended for the SOAR architecture and to be deployed on soar_sc service components.
+
 ## Contributing
 
 Bug reports and feature requests are welcome by email to ernst dot van dot graan at hetzner dot co dot za. This gem is sponsored by Hetzner (Pty) Ltd (http://hetzner.co.za)

data/lib/soar_pl/authorization_policy.rb

@@ -105,7 +105,7 @@ module SoarPl
     def setup
     end
 
-    def apply_rule_set(subject_identifier, requestor_identifier, resource_identifier, request, subject_roles, attribures)
+    def apply_rule_set(subject_identifier, requestor_identifier, resource_identifier, request, subject_roles, attributes)
       # override me
     end
 

data/lib/soar_pl/version.rb

@@ -1,3 +1,3 @@
 module SoarPl
-  VERSION = "0.0.1"
+  VERSION = "0.0.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: soar_pl
 version: !ruby/object:Gem::Version
-  version: 0.0.1
+  version: 0.0.2
 platform: ruby
 authors:
 - Ernst van Graan