applications/common/src/main/java/org/onap/policy/pdp/xacml/application/common/std/StdMatchableTranslator.java

   1 /*-
   2  * ============LICENSE_START=======================================================
   3  * ONAP
   4  * ================================================================================
   5  * Copyright (C) 2019 AT&T Intellectual Property. All rights reserved.
   6  * ================================================================================
   7  * Licensed under the Apache License, Version 2.0 (the "License");
   8  * you may not use this file except in compliance with the License.
   9  * You may obtain a copy of the License at
  10  *
  11  *      http://www.apache.org/licenses/LICENSE-2.0
  12  *
  13  * Unless required by applicable law or agreed to in writing, software
  14  * distributed under the License is distributed on an "AS IS" BASIS,
  15  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16  * See the License for the specific language governing permissions and
  17  * limitations under the License.
  18  *
  19  * SPDX-License-Identifier: Apache-2.0
  20  * ============LICENSE_END=========================================================
  21  */
  22
  23 package org.onap.policy.pdp.xacml.application.common.std;
  24
  25 import com.att.research.xacml.api.AttributeAssignment;
  26 import com.att.research.xacml.api.DataTypeException;
  27 import com.att.research.xacml.api.Decision;
  28 import com.att.research.xacml.api.Identifier;
  29 import com.att.research.xacml.api.Obligation;
  30 import com.att.research.xacml.api.Request;
  31 import com.att.research.xacml.api.Response;
  32 import com.att.research.xacml.api.Result;
  33 import com.att.research.xacml.api.XACML3;
  34 import com.att.research.xacml.std.annotations.RequestParser;
  35 import com.google.gson.Gson;
  36
  37 import java.util.Arrays;
  38 import java.util.Collection;
  39 import java.util.HashMap;
  40 import java.util.Map;
  41 import java.util.Map.Entry;
  42
  43 import oasis.names.tc.xacml._3_0.core.schema.wd_17.AnyOfType;
  44 import oasis.names.tc.xacml._3_0.core.schema.wd_17.AttributeAssignmentExpressionType;
  45 import oasis.names.tc.xacml._3_0.core.schema.wd_17.AttributeValueType;
  46 import oasis.names.tc.xacml._3_0.core.schema.wd_17.EffectType;
  47 import oasis.names.tc.xacml._3_0.core.schema.wd_17.MatchType;
  48 import oasis.names.tc.xacml._3_0.core.schema.wd_17.ObjectFactory;
  49 import oasis.names.tc.xacml._3_0.core.schema.wd_17.ObligationExpressionType;
  50 import oasis.names.tc.xacml._3_0.core.schema.wd_17.ObligationExpressionsType;
  51 import oasis.names.tc.xacml._3_0.core.schema.wd_17.PolicyType;
  52 import oasis.names.tc.xacml._3_0.core.schema.wd_17.RuleType;
  53 import oasis.names.tc.xacml._3_0.core.schema.wd_17.TargetType;
  54
  55 import org.onap.policy.common.utils.coder.CoderException;
  56 import org.onap.policy.common.utils.coder.StandardCoder;
  57 import org.onap.policy.models.decisions.concepts.DecisionRequest;
  58 import org.onap.policy.models.decisions.concepts.DecisionResponse;
  59 import org.onap.policy.models.tosca.authorative.concepts.ToscaPolicy;
  60 import org.onap.policy.pdp.xacml.application.common.ToscaDictionary;
  61 import org.onap.policy.pdp.xacml.application.common.ToscaPolicyConversionException;
  62 import org.onap.policy.pdp.xacml.application.common.ToscaPolicyTranslator;
  63 import org.onap.policy.pdp.xacml.application.common.ToscaPolicyTranslatorUtils;
  64 import org.slf4j.Logger;
  65 import org.slf4j.LoggerFactory;
  66
  67 public class StdMatchableTranslator implements ToscaPolicyTranslator {
  68
  69     private static final Logger LOGGER = LoggerFactory.getLogger(StdMatchableTranslator.class);
  70     private static final String POLICY_ID = "policy-id";
  71
  72     public StdMatchableTranslator() {
  73         super();
  74     }
  75
  76     @Override
  77     public Request convertRequest(DecisionRequest request) {
  78         LOGGER.info("Converting Request {}", request);
  79         try {
  80             return RequestParser.parseRequest(StdMatchablePolicyRequest.createInstance(request));
  81         } catch (IllegalArgumentException | IllegalAccessException | DataTypeException e) {
  82             LOGGER.error("Failed to convert DecisionRequest: {}", e);
  83         }
  84         //
  85         // TODO throw exception
  86         //
  87         return null;
  88     }
  89
  90     @Override
  91     public DecisionResponse convertResponse(Response xacmlResponse) {
  92         LOGGER.info("Converting Response {}", xacmlResponse);
  93         DecisionResponse decisionResponse = new DecisionResponse();
  94         //
  95         // Setup policies
  96         //
  97         decisionResponse.setPolicies(new HashMap<>());
  98         //
  99         // Iterate through all the results
 100         //
 101         for (Result xacmlResult : xacmlResponse.getResults()) {
 102             //
 103             // Check the result
 104             //
 105             if (xacmlResult.getDecision() == Decision.PERMIT) {
 106                 //
 107                 // Go through obligations
 108                 //
 109                 scanObligations(xacmlResult.getObligations(), decisionResponse);
 110             }
 111             if (xacmlResult.getDecision() == Decision.DENY
 112                     || xacmlResult.getDecision() == Decision.INDETERMINATE) {
 113                 //
 114                 // TODO we have to return an ErrorResponse object instead
 115                 //
 116                 decisionResponse.setStatus("A better error message");
 117             }
 118         }
 119
 120         return decisionResponse;
 121     }
 122
 123     protected void scanObligations(Collection<Obligation> obligations, DecisionResponse decisionResponse) {
 124         for (Obligation obligation : obligations) {
 125             LOGGER.info("Obligation: {}", obligation);
 126             for (AttributeAssignment assignment : obligation.getAttributeAssignments()) {
 127                 LOGGER.info("Attribute Assignment: {}", assignment);
 128                 //
 129                 // We care about the content attribute
 130                 //
 131                 if (ToscaDictionary.ID_OBLIGATION_POLICY_MONITORING_CONTENTS
 132                         .equals(assignment.getAttributeId())) {
 133                     //
 134                     // The contents are in Json form
 135                     //
 136                     Object stringContents = assignment.getAttributeValue().getValue();
 137                     if (LOGGER.isInfoEnabled()) {
 138                         LOGGER.info("Policy contents: {}{}", System.lineSeparator(), stringContents);
 139                     }
 140                     //
 141                     // Let's parse it into a map using Gson
 142                     //
 143                     Gson gson = new Gson();
 144                     @SuppressWarnings("unchecked")
 145                     Map<String, Object> result = gson.fromJson(stringContents.toString() ,Map.class);
 146                     //
 147                     // Find the metadata section
 148                     //
 149                     @SuppressWarnings("unchecked")
 150                     Map<String, Object> metadata = (Map<String, Object>) result.get("metadata");
 151                     if (metadata != null) {
 152                         decisionResponse.getPolicies().put(metadata.get(POLICY_ID).toString(), result);
 153                     } else {
 154                         LOGGER.error("Missing metadata section in policy contained in obligation.");
 155                     }
 156                 }
 157             }
 158         }
 159
 160     }
 161
 162     @Override
 163     public PolicyType convertPolicy(ToscaPolicy toscaPolicy) throws ToscaPolicyConversionException {
 164         //
 165         // Policy name should be at the root
 166         //
 167         String policyName = toscaPolicy.getMetadata().get(POLICY_ID);
 168         //
 169         // Set it as the policy ID
 170         //
 171         PolicyType newPolicyType = new PolicyType();
 172         newPolicyType.setPolicyId(policyName);
 173         //
 174         // Optional description
 175         //
 176         newPolicyType.setDescription(toscaPolicy.getDescription());
 177         //
 178         // There should be a metadata section
 179         //
 180         this.fillMetadataSection(newPolicyType, toscaPolicy.getMetadata());
 181         //
 182         // Set the combining rule
 183         //
 184         newPolicyType.setRuleCombiningAlgId(XACML3.ID_RULE_FIRST_APPLICABLE.stringValue());
 185         //
 186         // Generate the TargetType
 187         //
 188         newPolicyType.setTarget(generateTargetType(toscaPolicy.getProperties()));
 189         //
 190         // Now create the Permit Rule
 191         // No target since the policy has a target
 192         // With obligations.
 193         //
 194         RuleType rule = new RuleType();
 195         rule.setDescription("Default is to PERMIT if the policy matches.");
 196         rule.setRuleId(policyName + ":rule");
 197         rule.setEffect(EffectType.PERMIT);
 198         rule.setTarget(new TargetType());
 199         //
 200         // Now represent the policy as Json
 201         //
 202         StandardCoder coder = new StandardCoder();
 203         String jsonPolicy;
 204         try {
 205             jsonPolicy = coder.encode(toscaPolicy);
 206         } catch (CoderException e) {
 207             throw new ToscaPolicyConversionException("Failed to encode policy to json", e);
 208         }
 209         addObligation(rule, jsonPolicy);
 210         //
 211         // Add the rule to the policy
 212         //
 213         newPolicyType.getCombinerParametersOrRuleCombinerParametersOrVariableDefinition().add(rule);
 214         //
 215         // Return our new policy
 216         //
 217         return newPolicyType;
 218     }
 219
 220     /**
 221      * From the TOSCA metadata section, pull in values that are needed into the XACML policy.
 222      *
 223      * @param policy Policy Object to store the metadata
 224      * @param map The Metadata TOSCA Map
 225      * @return Same Policy Object
 226      * @throws ToscaPolicyConversionException If there is something missing from the metadata
 227      */
 228     protected PolicyType fillMetadataSection(PolicyType policy,
 229             Map<String, String> map) throws ToscaPolicyConversionException {
 230         if (! map.containsKey(POLICY_ID)) {
 231             throw new ToscaPolicyConversionException(policy.getPolicyId() + " missing metadata policy-id");
 232         } else {
 233             //
 234             // Do nothing here - the XACML PolicyId is used from TOSCA Policy Name field
 235             //
 236         }
 237         if (! map.containsKey("policy-version")) {
 238             throw new ToscaPolicyConversionException(policy.getPolicyId() + " missing metadata policy-version");
 239         } else {
 240             //
 241             // Add in the Policy Version
 242             //
 243             policy.setVersion(map.get("policy-version"));
 244         }
 245         return policy;
 246     }
 247
 248     /**
 249      * For generating target type, we are making an assumption that the
 250      * policyScope and policyType are the fields that OOF wants to match on.
 251      *
 252      * <P>In the future, we would need to receive the Policy Type specification
 253      * from the PAP so we can dynamically see which fields are matchable.
 254      *
 255      * <P>Note: I am making an assumption that the matchable fields are what
 256      * the OOF wants to query a policy on.
 257      *
 258      * @param properties Properties section of policy
 259      * @return TargetType object
 260      */
 261     @SuppressWarnings("unchecked")
 262     protected TargetType generateTargetType(Map<String, Object> properties) {
 263         TargetType targetType = new TargetType();
 264         //
 265         // Iterate the properties
 266         //
 267         for (Entry<String, Object> entrySet : properties.entrySet()) {
 268             //
 269             // Find policyScope and policyType
 270             //
 271             if (entrySet.getKey().equals("policyScope")) {
 272                 LOGGER.info("Found policyScope: {}", entrySet.getValue());
 273                 if (entrySet.getValue() instanceof Collection) {
 274                     targetType.getAnyOf().add(generateMatches((Collection<Object>) entrySet.getValue(),
 275                             ToscaDictionary.ID_RESOURCE_POLICY_SCOPE_PROPERTY));
 276                 } else if (entrySet.getValue() instanceof String) {
 277                     targetType.getAnyOf().add(generateMatches(Arrays.asList(entrySet.getValue()),
 278                             ToscaDictionary.ID_RESOURCE_POLICY_SCOPE_PROPERTY));
 279                 }
 280             }
 281             if (entrySet.getKey().equals("policyType")) {
 282                 LOGGER.info("Found policyType: {}", entrySet.getValue());
 283                 if (entrySet.getValue() instanceof Collection) {
 284                     targetType.getAnyOf().add(generateMatches((Collection<Object>) entrySet.getValue(),
 285                             ToscaDictionary.ID_RESOURCE_POLICY_TYPE_PROPERTY));
 286                 } else if (entrySet.getValue() instanceof String) {
 287                     targetType.getAnyOf().add(generateMatches(Arrays.asList(entrySet.getValue()),
 288                             ToscaDictionary.ID_RESOURCE_POLICY_TYPE_PROPERTY));
 289                 }
 290             }
 291         }
 292
 293         return targetType;
 294     }
 295
 296     protected AnyOfType generateMatches(Collection<Object> matchables, Identifier attributeId) {
 297         //
 298         // This is our outer AnyOf - which is an OR
 299         //
 300         AnyOfType anyOf = new AnyOfType();
 301         for (Object matchable : matchables) {
 302             //
 303             // Create a match for this
 304             //
 305             MatchType match = ToscaPolicyTranslatorUtils.buildMatchTypeDesignator(
 306                     XACML3.ID_FUNCTION_STRING_EQUAL,
 307                     matchable.toString(),
 308                     XACML3.ID_DATATYPE_STRING,
 309                     attributeId,
 310                     XACML3.ID_ATTRIBUTE_CATEGORY_RESOURCE);
 311             //
 312             // Now create an anyOf (OR)
 313             //
 314             anyOf.getAllOf().add(ToscaPolicyTranslatorUtils.buildAllOf(match));
 315         }
 316         return anyOf;
 317     }
 318
 319     protected RuleType addObligation(RuleType rule, String jsonPolicy) {
 320         //
 321         // Convert the YAML Policy to JSON Object
 322         //
 323         if (LOGGER.isInfoEnabled()) {
 324             LOGGER.info("JSON Optimization Policy {}{}", System.lineSeparator(), jsonPolicy);
 325         }
 326         //
 327         // Create an AttributeValue for it
 328         //
 329         AttributeValueType value = new AttributeValueType();
 330         value.setDataType(ToscaDictionary.ID_OBLIGATION_POLICY_MONITORING_DATATYPE.stringValue());
 331         value.getContent().add(jsonPolicy);
 332         //
 333         // Create our AttributeAssignmentExpression where we will
 334         // store the contents of the policy in JSON format.
 335         //
 336         AttributeAssignmentExpressionType expressionType = new AttributeAssignmentExpressionType();
 337         expressionType.setAttributeId(ToscaDictionary.ID_OBLIGATION_POLICY_MONITORING_CONTENTS.stringValue());
 338         ObjectFactory factory = new ObjectFactory();
 339         expressionType.setExpression(factory.createAttributeValue(value));
 340         //
 341         // Create an ObligationExpression for it
 342         //
 343         ObligationExpressionType obligation = new ObligationExpressionType();
 344         obligation.setFulfillOn(EffectType.PERMIT);
 345         obligation.setObligationId(ToscaDictionary.ID_OBLIGATION_REST_BODY.stringValue());
 346         obligation.getAttributeAssignmentExpression().add(expressionType);
 347         //
 348         // Now we can add it into the rule
 349         //
 350         ObligationExpressionsType obligations = new ObligationExpressionsType();
 351         obligations.getObligationExpression().add(obligation);
 352         rule.setObligationExpressions(obligations);
 353         return rule;
 354     }
 355
 356 }