Adds Duration Extension and Offset Function support

[muditchaudhary]

Overview

• Adds Duration extension and Offset functions (RFC 80)
• Adds missing support for negative decimal and CIDR suffixes '

Changes

• Implements com.cedarpolicy.value.Duration
  • Validates input against supported format specifications
  • Converts and stores it in millisecond format for semantic comparison
  • Adds JSON Serializer and Deserializer support
  • Adds unit and integration tests
• Implements com.cedarpolicy.value.functions.Offset
  • Adds JSON Serializer and Deserializer support
  • Does not implement equals or hash as this is supposed to represent a function
  • Adds unit and integration tests
• Bug Fixes (Cause for previously failing shared integration corpus tests)
  • Adds support negative decimals in com.cedarpolicy.value.Decimal
  • Adds support for CIDR suffix in com.cedarpolicy.value.IpAddress
• Test logging
  • Adds additional corpus test logging to ease debugging

Example Usage

Duration

Set<Entity> entities = new HashSet<>();
String principalId = "alice";
Map<String, Value> principalAttributes = new HashMap<>();
principalAttributes.put("sessionDuration", new Duration("2h30m"));
Set<EntityUID> principalParents = new HashSet<>();
Entity principal = new Entity(new EntityUID(principalType, principalId), principalAttributes, principalParents);
entities.add(principal);

String actionId = "view";
Map<String, Value> actionAttributes = new HashMap<>();
Set<EntityUID> actionParents = new HashSet<>();
Entity action = new Entity(new EntityUID(actionType, actionId), actionAttributes, actionParents);
entities.add(action);

String resourceId = "photo.jpg";
Map<String, Value> resourceAttributes = new HashMap<>();
Set<EntityUID> resourceParents = new HashSet<>();
var resource = new Entity(new EntityUID(resourceType, resourceId), resourceAttributes, resourceParents);
entities.add(resource);

String p =
        "permit(\n"
                + "principal==" + principal.getEUID().toString() + ",\n"
                + "action==" + action.getEUID().toString() + ",\n"
                + "resource==" + resource.getEUID().toString() + "\n)\n"
                + " when {\n"
                + "principal.sessionDuration > duration(\"1h\")};";
final String policyId = "ID0";
Policy policy = new Policy(p, policyId);
Set<Policy> policies = new HashSet<>();
policies.add(policy);
PolicySet policySet = new PolicySet(policies);
Map<String, Value> currentContext = new HashMap<>();
AuthorizationRequest request =
        new AuthorizationRequest(
                principal, action, resource, currentContext);

Offset

Set<Entity> entities = new HashSet<>();
String principalId = "alice";
Map<String, Value> principalAttributes = new HashMap<>();
DateTime baseDateTime = new DateTime("2023-12-25T10:30:45Z");
Duration offsetDuration = new Duration("2h");
principalAttributes.put("appointmentTime", new Offset(baseDateTime, offsetDuration));
Set<EntityUID> principalParents = new HashSet<>();
Entity principal = new Entity(new EntityUID(principalType, principalId), principalAttributes, principalParents);
entities.add(principal);

String actionId = "view";
Map<String, Value> actionAttributes = new HashMap<>();
Set<EntityUID> actionParents = new HashSet<>();
Entity action = new Entity(new EntityUID(actionType, actionId), actionAttributes, actionParents);
entities.add(action);

String resourceId = "photo.jpg";
Map<String, Value> resourceAttributes = new HashMap<>();
Set<EntityUID> resourceParents = new HashSet<>();
var resource = new Entity(new EntityUID(resourceType, resourceId), resourceAttributes, resourceParents);
entities.add(resource);

String p =
        "permit(\n"
                + "principal=="+ principal.getEUID().toString() + ",\n"
                + "action==" + action.getEUID().toString() + ",\n"
                + "resource==" + resource.getEUID().toString() + "\n)\n"
                + " when {\n"
                + "principal.appointmentTime == datetime(\"2023-12-25T10:30:45Z\").offset(duration(\"2h\"))\n};";
final String policyId = "ID0";
Policy policy = new Policy(p, policyId);
Set<Policy> policies = new HashSet<>();
policies.add(policy);
PolicySet policySet = new PolicySet(policies);
Map<String, Value> currentContext = new HashMap<>();
AuthorizationRequest request =
        new AuthorizationRequest(
                principal, action, resource, currentContext);

[adpaco-aws]

The code before this is going to overflow before negating the i64::MIN value. In other words, this code should be able to parse duration("-9223372036854775808ms") but it doesn't currently because it'll overflow before getting here.

[muditchaudhary]

Nice catch. I'll update it and also add the test cases from lean

[muditchaudhary]

Resolved in the revision

[adpaco-aws]

Does this mean you couldn't accept ranges before?

[muditchaudhary]

Apparently yes. We just caught it due to the updated corpus tests

[adpaco-aws]

In that case, this fix probably deserves its own PR. You could probably ship it faster that way, and also include unit tests to make sure we've actually fixed this case. Not a blocker for this PR though.

[muditchaudhary]

I'll add a couple of tests in a subsequent PR