Skip to content

datalog components parser helper and authorization helper #119

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
KannarFr wants to merge 2 commits into from
Closed

datalog components parser helper and authorization helper #119

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3c01e13
add datalog components parser and authorizer helper using it
KannarFr Apr 4, 2025
8248852
add test.
KannarFr Apr 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions src/main/java/org/biscuitsec/biscuit/token/Authorizer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
import static io.vavr.API.Right;

import io.vavr.Tuple2;
import io.vavr.Tuple4;
import io.vavr.control.Either;
import io.vavr.control.Option;
import java.time.Instant;
Expand Down Expand Up @@ -203,6 +204,32 @@ public Authorizer addToken(Biscuit token) throws Error.FailedLogic {
return this;
}

public Either<Map<Integer, List<Error>>, Authorizer> addDatalog(String s) {
Either<Map<Integer, List<org.biscuitsec.biscuit.token.builder.parser.Error>>, Tuple4<List<org.biscuitsec.biscuit.token.builder.Fact>, List<org.biscuitsec.biscuit.token.builder.Rule>, List<org.biscuitsec.biscuit.token.builder.Check>, List<org.biscuitsec.biscuit.token.builder.Scope>>> result = Parser
.datalogComponents(s);

if (result.isLeft()) {
Map<Integer, List<org.biscuitsec.biscuit.token.builder.parser.Error>> errors = result.getLeft();
Map<Integer, List<Error>> errorMap = new HashMap<>();
for (Map.Entry<Integer, List<org.biscuitsec.biscuit.token.builder.parser.Error>> entry : errors.entrySet()) {
List<Error> errorsList = new ArrayList<>();
for (org.biscuitsec.biscuit.token.builder.parser.Error error : entry.getValue()) {
errorsList.add(new Error.Parser(error));
}
errorMap.put(entry.getKey(), errorsList);
}
return Either.left(errorMap);
}

Tuple4<List<org.biscuitsec.biscuit.token.builder.Fact>, List<org.biscuitsec.biscuit.token.builder.Rule>, List<org.biscuitsec.biscuit.token.builder.Check>, List<org.biscuitsec.biscuit.token.builder.Scope>> components = result
.get();
components._1.forEach(this::addFact);
components._2.forEach(this::addRule);
components._3.forEach(this::addCheck);

return Either.right(this);
}

public Authorizer addFact(org.biscuitsec.biscuit.token.builder.Fact fact) {
world.addFact(Origin.authorizer(), fact.convert(symbolTable));
return this;
Expand Down
132 changes: 82 additions & 50 deletions src/main/java/org/biscuitsec/biscuit/token/builder/parser/Parser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,16 +34,19 @@ private Parser() {}
*
* <p>If one succeeds it returns Right(Block) else it returns a Map[lineNumber, List[Error]]
*
* @param index block index
* @param s datalog string to parse
* @return Either<Map<Integer, List<Error>>, Block>
* @return Either<Map<Integer, List<Error>>, Tuple4<List<Fact>, List<Rule>,
* List<Check>, List<Scope>>>
*/
public static Either<Map<Integer, List<Error>>, Block> datalog(long index, String s) {
Block blockBuilder = new Block();
public static Either<Map<Integer, List<Error>>, Tuple4<List<Fact>, List<Rule>, List<Check>, List<Scope>>> datalogComponents(
String s) {
List<Fact> facts = new ArrayList<>();
List<Rule> rules = new ArrayList<>();
List<Check> checks = new ArrayList<>();
List<Scope> scopes = new ArrayList<>();

// empty block code
if (s.isEmpty()) {
return Either.right(blockBuilder);
return Either.right(new Tuple4<>(facts, rules, checks, scopes));
}

Map<Integer, List<Error>> errors = new HashMap<>();
Expand All @@ -61,58 +64,54 @@ public static Either<Map<Integer, List<Error>>, Block> datalog(long index, Strin
List<Error> lineErrors = new ArrayList<>();

boolean parsed = false;
parsed =
rule(code)
.fold(
e -> {
lineErrors.add(e);
return false;
},
r -> {
blockBuilder.addRule(r._2);
return true;
});
parsed = rule(code)
.fold(
e -> {
lineErrors.add(e);
return false;
},
r -> {
rules.add(r._2);
return true;
});

if (!parsed) {
parsed =
fact(code)
.fold(
e -> {
lineErrors.add(e);
return false;
},
r -> {
blockBuilder.addFact(r._2);
return true;
});
parsed = fact(code)
.fold(
e -> {
lineErrors.add(e);
return false;
},
r -> {
facts.add(r._2);
return true;
});
}

if (!parsed) {
parsed =
check(code)
.fold(
e -> {
lineErrors.add(e);
return false;
},
r -> {
blockBuilder.addCheck(r._2);
return true;
});
parsed = check(code)
.fold(
e -> {
lineErrors.add(e);
return false;
},
r -> {
checks.add(r._2);
return true;
});
}

if (!parsed) {
parsed =
scope(code)
.fold(
e -> {
lineErrors.add(e);
return false;
},
r -> {
blockBuilder.addScope(r._2);
return true;
});
parsed = scope(code)
.fold(
e -> {
lineErrors.add(e);
return false;
},
r -> {
scopes.add(r._2);
return true;
});
}

if (!parsed) {
Expand All @@ -127,6 +126,39 @@ public static Either<Map<Integer, List<Error>>, Block> datalog(long index, Strin
return Either.left(errors);
}

return Either.right(new Tuple4<>(facts, rules, checks, scopes));
}

/**
* Takes a datalog string with <code>\n</code> as datalog line separator. It
* tries to parse each
* line using fact, rule, check and scope sequentially.
*
* <p>
* If one succeeds it returns Right(Block) else it returns a Map[lineNumber,
* List[Error]]
*
* @param index block index
* @param s datalog string to parse
* @return Either<Map<Integer, List<Error>>, Block>
*/
public static Either<Map<Integer, List<Error>>, Block> datalog(long index, String s) {
Block blockBuilder = new Block();

Either<Map<Integer, List<Error>>, Tuple4<List<Fact>, List<Rule>, List<Check>, List<Scope>>> result = datalogComponents(
s);

if (result.isLeft()) {
return Either.left(result.getLeft());
}

Tuple4<List<Fact>, List<Rule>, List<Check>, List<Scope>> components = result.get();

components._1.forEach(blockBuilder::addFact);
components._2.forEach(blockBuilder::addRule);
components._3.forEach(blockBuilder::addCheck);
components._4.forEach(blockBuilder::addScope);

return Either.right(blockBuilder);
}

Expand Down
29 changes: 29 additions & 0 deletions src/test/java/org/biscuitsec/biscuit/token/AuthorizerTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
package org.biscuitsec.biscuit.token;

import static org.biscuitsec.biscuit.token.builder.Utils.constrainedRule;
import static org.junit.Assert.assertTrue;
import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
import static org.junit.jupiter.api.Assertions.assertEquals;

import biscuit.format.schema.Schema;
Expand Down Expand Up @@ -73,6 +75,33 @@ public void testPuttingSomeFactsInBiscuitAndGettingThemBackOutAgain() throws Exc
((Term.Set) permsTerm).getValue());
}

@Test
public void testDatalogAuthorizer() throws Exception {
KeyPair keypair = KeyPair.generate(Schema.PublicKey.Algorithm.Ed25519, new SecureRandom());

Biscuit token = Biscuit.builder(keypair)
.addAuthorityFact("email(\"[email protected]\")")
.addAuthorityFact("id(123)")
.addAuthorityFact("enabled(true)")
.addAuthorityFact("perms([1,2,3])")
.build();

Authorizer authorizer = Biscuit.fromBase64Url(token.serializeBase64Url(), keypair.getPublicKey())
.verify(keypair.getPublicKey())
.authorizer();

String l0 = "right($email) <- email($email)";
String l1 = "check if right(\"[email protected]\")";
String datalog = String.join(";", Arrays.asList(l0, l1));
authorizer.addDatalog(datalog);
authorizer.addPolicy("allow if true");

assertDoesNotThrow(() -> authorizer.authorize());

Term emailTerm = queryFirstResult(authorizer, "right($address) <- email($address)");
assertEquals("[email protected]", ((Term.Str) emailTerm).getValue());
}

private static Term queryFirstResult(Authorizer authorizer, String query) throws Error {
return authorizer.query(query).iterator().next().terms().get(0);
}
Expand Down