Ability to allow or deny registered functions execution

Author: Rajesh Jinaga

src/Simpleflow/CodeGenerator/ParserEventPublisher.cs

@@ -0,0 +1,22 @@
+// Copyright (c) navtech.io. All rights reserved. 
+// See License in the project root for license information.
+
+using System;
+
+namespace Simpleflow.CodeGenerator
+{
+    internal enum EventType
+    {
+        None,
+        VisitFunctionOnAvail
+    }
+    internal class ParserEventPublisher
+    {
+        public Action<EventType, object> OnVisit;
+
+        public void Publish(EventType eventType, object data)
+        {
+            OnVisit(eventType, data);
+        }
+    }
+}

src/Simpleflow/CodeGenerator/SimpleflowCodeVisitor.VisitFunction.cs

@@ -21,16 +21,19 @@ partial class SimpleflowCodeVisitor<TArg>
 
         public override Expression VisitFunction([NotNull] SimpleflowParser.FunctionContext context)
         {
-            var functionName = context.FunctionName().GetText();
+            var functionName = context.FunctionName().GetText().Substring(1); // Remove $ symbol
 
             // Get registered function
-            var function = FunctionRegister.GetFunction(functionName.Substring(1)); // Remove $ symbol
+            var function = FunctionRegister.GetFunction(functionName); 
 
             if (function == null)
             {
                 throw new InvalidFunctionException(functionName);
             }
 
+            // Publish event once function is available to compile
+            EventPublisher.Publish(EventType.VisitFunctionOnAvail, functionName);
+
             // Get actual method meta-data info and parameters
             var methodInfo = function.GetMethodInfo();
 

src/Simpleflow/CodeGenerator/SimpleflowCodeVisitor.cs

@@ -27,9 +27,12 @@ internal partial class SimpleflowCodeVisitor<TArg> : SimpleflowBaseVisitor<Expre
         protected readonly ParameterExpression Output; // script main function parameter 2
         protected readonly ParameterExpression ScriptHelperContext; //script main function  parameter 3
 
-        public SimpleflowCodeVisitor(IFunctionRegister functionRegister)
+        protected readonly ParserEventPublisher EventPublisher;
+
+        public SimpleflowCodeVisitor(IFunctionRegister functionRegister, ParserEventPublisher eventPublisher)
         {
             FunctionRegister = functionRegister ?? throw new ArgumentNullException(nameof(functionRegister));
+            EventPublisher = eventPublisher;
 
             /* Initialize smart variables and smart json variables */
             Variables = new List<ParameterExpression>();

src/Simpleflow/CodeGenerator/SimpleflowCompiler.cs

@@ -15,7 +15,9 @@ namespace Simpleflow.CodeGenerator
     internal class SimpleflowCompiler
     {
 
-        public static Action<FlowInput<TArg>, FlowOutput, ScriptHelperContext> Compile<TArg>(string code, IFunctionRegister activityRegister)
+        public static Action<FlowInput<TArg>, FlowOutput, ScriptHelperContext> Compile<TArg>(string code, 
+            IFunctionRegister activityRegister, 
+            ParserEventPublisher eventPublisher)
         {
             var inputStream = new AntlrInputStream(code);
 
@@ -43,8 +45,9 @@ public static Action<FlowInput<TArg>, FlowOutput, ScriptHelperContext> Compile<T
                 throw new SyntaxException(errorListener.GetAggregateMessages(), errorListener.Errors);
             }
 
+            
             // Generate code
-            var visitor = new SimpleflowCodeVisitor<TArg>(activityRegister);
+            var visitor = new SimpleflowCodeVisitor<TArg>(activityRegister, eventPublisher);
             var program = visitor.Visit(programContext);
 
             // Compile

src/Simpleflow/Exceptions/AccessDeniedException.cs

@@ -0,0 +1,13 @@
+// Copyright (c) navtech.io. All rights reserved. 
+// See License in the project root for license information.
+
+namespace Simpleflow.Exceptions
+{
+    public class AccessDeniedException : SimpleflowException
+    {
+        public AccessDeniedException(string message) : base(message)
+        {
+
+        }
+    }
+}

src/Simpleflow/FlowOptions.cs

@@ -15,11 +15,11 @@ public class FlowOptions : IOptions
         /// <summary>
         /// Gets or sets AllowFunctions
         /// </summary>
-        public string[] AllowOnlyFunctions { get; set; }
+        public string[] AllowFunctions { get; set; }
 
         /// <summary>
         /// Gets or sets DenyFunctions
         /// </summary>
-        public string[] DenyOnlyFunctions { get; set; }
+        public string[] DenyFunctions { get; set; }
     }
 }

src/Simpleflow/IOptions.cs

@@ -14,19 +14,14 @@ public interface IOptions
         bool AllowArgumentToMutate { get;  }
 
         /// <summary>
-        /// Gets or sets AllowFunctions, 
-        /// if nothing is specified all configured functions will be allowed.
-        /// Either <see cref="AllowOnlyFunctions"/> or <see cref="DenyOnlyFunctions"/> 
-        /// must be set, not both.
+        /// Gets or sets AllowFunctions
         /// </summary>
-        public string[] AllowOnlyFunctions { get; set; }
+        public string[] AllowFunctions { get; set; }
 
 
         /// <summary>
         /// Gets or sets DenyFunctions.
-        /// Either <see cref="AllowOnlyFunctions"/> or <see cref="DenyOnlyFunctions"/> 
-        /// must be set, not both.
         /// </summary>
-        public string[] DenyOnlyFunctions { get; set; }
+        public string[] DenyFunctions { get; set; }
     }
 }

src/Simpleflow/Services/CacheService.cs

@@ -106,8 +106,8 @@ protected virtual string GetScriptUniqueId(string script)
         private string GetFlowContextOptionsId(IContextOptions options)
         {
             if (options.AllowArgumentToMutate == false 
-                && (options.AllowOnlyFunctions == null || options.AllowOnlyFunctions.Length == 0)
-                && (options.DenyOnlyFunctions == null  || options.DenyOnlyFunctions.Length == 0)
+                && (options.AllowFunctions == null || options.AllowFunctions.Length == 0)
+                && (options.DenyFunctions == null  || options.DenyFunctions.Length == 0)
                 )
             {
                 return string.Empty;
@@ -116,16 +116,16 @@ private string GetFlowContextOptionsId(IContextOptions options)
             StringBuilder sb = new StringBuilder();
             sb.Append(string.Join(' ', options.AllowArgumentToMutate));
 
-            if (options.AllowOnlyFunctions != null && options.AllowOnlyFunctions.Length > 0)
+            if (options.AllowFunctions != null && options.AllowFunctions.Length > 0)
             {
                 sb.Append("Allow"); //ensure add this to avoid collisions
-                sb.Append(string.Join(' ', options.AllowOnlyFunctions));
+                sb.Append(string.Join(' ', options.AllowFunctions));
             }
 
-            if (options.DenyOnlyFunctions != null && options.DenyOnlyFunctions.Length > 0)
+            if (options.DenyFunctions != null && options.DenyFunctions.Length > 0)
             {
                 sb.Append("Deny"); //ensure add this to avoid collisions
-                sb.Append(string.Join(' ', options.DenyOnlyFunctions ));
+                sb.Append(string.Join(' ', options.DenyFunctions ));
             }
 
             return GetScriptUniqueId(sb.ToString());

src/Simpleflow/Services/CompilerService.cs

@@ -2,7 +2,9 @@
 // See License in the project root for license information.
 
 using System;
+using System.Linq;
 using Simpleflow.CodeGenerator;
+using Simpleflow.Exceptions;
 
 namespace Simpleflow.Services
 {
@@ -34,7 +36,10 @@ So here we don't need to run again  */
 
             if (context.Internals.CompiledScript == null)
             {
-                context.Internals.CompiledScript = SimpleflowCompiler.Compile<TArg>(context.Script, _activityRegister);
+                var eventPublisher = new ParserEventPublisher();
+                CheckFunctionExecutionPermissions(context, eventPublisher);
+
+                context.Internals.CompiledScript = SimpleflowCompiler.Compile<TArg>(context.Script, _activityRegister, eventPublisher);
 
                 context.Trace.Write("Compiled");
             }
@@ -45,5 +50,33 @@ So here we don't need to run again  */
 
             next?.Invoke(context);
         }
+
+        private static void CheckFunctionExecutionPermissions<TArg>(FlowContext<TArg> context, ParserEventPublisher eventPublisher)
+        {
+            eventPublisher.OnVisit = (type, data) =>
+            {
+                if (type == EventType.VisitFunctionOnAvail 
+                    && context.Options?.DenyFunctions != null)
+                {
+                    var functionName = data.ToString();
+                    if (context.Options.DenyFunctions.Contains(functionName, StringComparer.OrdinalIgnoreCase))
+                    {
+                        throw new AccessDeniedException($"Function '{functionName}' cannot be allowed to run in this context.");
+                    }
+                }
+
+                if (type == EventType.VisitFunctionOnAvail
+                    && context.Options?.AllowFunctions != null)
+                {
+                    var functionName = data.ToString();
+                    if (!context.Options.AllowFunctions.Contains(functionName, StringComparer.OrdinalIgnoreCase))
+                    {
+                        throw new AccessDeniedException($"Function '{functionName}' cannot be allowed to run in this context.");
+                    }
+                }
+            };
+        }
+
+
     }
 }