|
| 1 | +package rulesengine |
| 2 | + |
| 3 | +import ( |
| 4 | + "log/slog" |
| 5 | + neturl "net/url" |
| 6 | + "strings" |
| 7 | +) |
| 8 | + |
| 9 | +// Engine evaluates HTTP requests against a set of rules. |
| 10 | +type Engine struct { |
| 11 | + rules []Rule |
| 12 | + logger *slog.Logger |
| 13 | +} |
| 14 | + |
| 15 | +// NewRuleEngine creates a new rule engine |
| 16 | +func NewRuleEngine(rules []Rule, logger *slog.Logger) Engine { |
| 17 | + return Engine{ |
| 18 | + rules: rules, |
| 19 | + logger: logger, |
| 20 | + } |
| 21 | +} |
| 22 | + |
| 23 | +// Result contains the result of rule evaluation |
| 24 | +type Result struct { |
| 25 | + Allowed bool |
| 26 | + Rule string // The rule that matched (if any) |
| 27 | +} |
| 28 | + |
| 29 | +// Evaluate evaluates a request and returns both result and matching rule |
| 30 | +func (re *Engine) Evaluate(method, url string) Result { |
| 31 | + // Check if any allow rule matches |
| 32 | + for _, rule := range re.rules { |
| 33 | + if re.matches(rule, method, url) { |
| 34 | + return Result{ |
| 35 | + Allowed: true, |
| 36 | + Rule: rule.Raw, |
| 37 | + } |
| 38 | + } |
| 39 | + } |
| 40 | + |
| 41 | + // Default deny if no allow rules match |
| 42 | + return Result{ |
| 43 | + Allowed: false, |
| 44 | + Rule: "", |
| 45 | + } |
| 46 | +} |
| 47 | + |
| 48 | +// Matches checks if the rule matches the given method and URL using wildcard patterns |
| 49 | +func (re *Engine) matches(r Rule, method, url string) bool { |
| 50 | + |
| 51 | + // Check method patterns if they exist |
| 52 | + if r.MethodPatterns != nil { |
| 53 | + methodMatches := false |
| 54 | + for mp := range r.MethodPatterns { |
| 55 | + if string(mp) == method || string(mp) == "*" { |
| 56 | + methodMatches = true |
| 57 | + break |
| 58 | + } |
| 59 | + } |
| 60 | + if !methodMatches { |
| 61 | + re.logger.Debug("rule does not match", "reason", "method pattern mismatch", "rule", r.Raw, "method", method, "url", url) |
| 62 | + return false |
| 63 | + } |
| 64 | + } |
| 65 | + |
| 66 | + parsedUrl, err := neturl.Parse(url) |
| 67 | + if err != nil { |
| 68 | + re.logger.Debug("rule does not match", "reason", "invalid URL", "rule", r.Raw, "method", method, "url", url, "error", err) |
| 69 | + return false |
| 70 | + } |
| 71 | + |
| 72 | + if r.HostPattern != nil { |
| 73 | + // For a host pattern to match, every label has to match or be an `*`. |
| 74 | + // Subdomains also match automatically, meaning if the pattern is "example.com" |
| 75 | + // and the real is "api.example.com", it should match. We check this by comparing |
| 76 | + // from the end of the actual hostname with the pattern (which is in normal order). |
| 77 | + |
| 78 | + labels := strings.Split(parsedUrl.Hostname(), ".") |
| 79 | + |
| 80 | + // If the host pattern is longer than the actual host, it's definitely not a match |
| 81 | + if len(r.HostPattern) > len(labels) { |
| 82 | + re.logger.Debug("rule does not match", "reason", "host pattern too long", "rule", r.Raw, "method", method, "url", url, "pattern_length", len(r.HostPattern), "hostname_labels", len(labels)) |
| 83 | + return false |
| 84 | + } |
| 85 | + |
| 86 | + // Since host patterns cannot end with asterisk, we only need to handle: |
| 87 | + // "example.com" or "*.example.com" - match from the end (allowing subdomains) |
| 88 | + for i, lp := range r.HostPattern { |
| 89 | + labelIndex := len(labels) - len(r.HostPattern) + i |
| 90 | + if string(lp) != labels[labelIndex] && lp != "*" { |
| 91 | + re.logger.Debug("rule does not match", "reason", "host pattern label mismatch", "rule", r.Raw, "method", method, "url", url, "expected", string(lp), "actual", labels[labelIndex]) |
| 92 | + return false |
| 93 | + } |
| 94 | + } |
| 95 | + } |
| 96 | + |
| 97 | + if r.PathPattern != nil { |
| 98 | + segments := strings.Split(parsedUrl.Path, "/") |
| 99 | + |
| 100 | + // Skip the first empty segment if the path starts with "/" |
| 101 | + if len(segments) > 0 && segments[0] == "" { |
| 102 | + segments = segments[1:] |
| 103 | + } |
| 104 | + |
| 105 | + // If the path pattern is longer than the actual path, definitely not a match |
| 106 | + if len(r.PathPattern) > len(segments) { |
| 107 | + re.logger.Debug("rule does not match", "reason", "path pattern too long", "rule", r.Raw, "method", method, "url", url, "pattern_length", len(r.PathPattern), "path_segments", len(segments)) |
| 108 | + return false |
| 109 | + } |
| 110 | + |
| 111 | + // Each segment in the pattern must be either as asterisk or match the actual path segment |
| 112 | + for i, sp := range r.PathPattern { |
| 113 | + if string(sp) != segments[i] && sp != "*" { |
| 114 | + re.logger.Debug("rule does not match", "reason", "path pattern segment mismatch", "rule", r.Raw, "method", method, "url", url, "expected", string(sp), "actual", segments[i]) |
| 115 | + return false |
| 116 | + } |
| 117 | + } |
| 118 | + } |
| 119 | + |
| 120 | + re.logger.Debug("rule matches", "reason", "all patterns matched", "rule", r.Raw, "method", method, "url", url) |
| 121 | + return true |
| 122 | +} |
0 commit comments