refactor(jans-cedarling): handle recoverable errors gracefully in authorization

jans-cedarling/bindings/cedarling_python/PYTHON_TYPES.md

@@ -205,47 +205,11 @@ error : str
     The error message describing the evaluation failure.
 ___
 
-# authorize_errors.ActionError
-Error encountered while parsing Action to EntityUid
-___
-
 # authorize_errors.AuthorizeError
 Exception raised by authorize_errors
 ___
 
-# authorize_errors.BuildContextError
-Error encountered while building the request context
-___
-
-# authorize_errors.BuildEntityError
-Error encountered while running on strict id token trust mode
-___
-
-# authorize_errors.CreateContextError
-Error encountered while validating context according to the schema
-___
-
-# authorize_errors.EntitiesError
-Error encountered while collecting all entities
-___
-
-# authorize_errors.EntitiesToJsonError
-Error encountered while parsing all entities to json for logging
-___
-
-# authorize_errors.IdTokenTrustModeError
-Error encountered while running on strict id token trust mode
-___
-
-# authorize_errors.ProcessTokens
-Error encountered while processing JWT token data
-___
-
-# authorize_errors.UserRequestValidationError
-Error encountered while creating cedar_policy::Request for user entity principal
-___
-
-# authorize_errors.WorkloadRequestValidationError
-Error encountered while creating cedar_policy::Request for workload entity principal
+# authorize_errors.LoggingError
+Error encountered while trying to write logs
 ___
 

jans-cedarling/bindings/cedarling_python/cedarling_python.pyi

@@ -191,6 +191,8 @@ class AuthorizeResult:
 
     def person(self) -> AuthorizeResultResponse | None: ...
 
+    def reason_input(self) -> String | None: ...
+
 
 @final
 class AuthorizeResultResponse:

jans-cedarling/bindings/cedarling_python/example.py

@@ -238,16 +238,16 @@ def load_yaml_to_env(yaml_path):
 
 print()
 
-# watch on the decision for person
-person_result = authorize_result.person()
-print(f"Result of person authorization: {person_result.decision}")
-person_diagnostic = person_result.diagnostics
+# watch on the decision for user
+user_result = authorize_result.user()
+print(f"Result of user authorization: {user_result.decision}")
+user_diagnostic = user_result.diagnostics
 print("Policy ID used:")
-for diagnostic in person_diagnostic.reason:
+for diagnostic in user_diagnostic.reason:
     print(diagnostic)
 
-print(f"Errors during authorization: {len(person_diagnostic.errors)}")
-for diagnostic in person_diagnostic.errors:
+print(f"Errors during authorization: {len(user_diagnostic.errors)}")
+for diagnostic in user_diagnostic.errors:
     print(diagnostic)
 
 print()

jans-cedarling/bindings/cedarling_python/src/authorize/authorize_result.rs

@@ -38,9 +38,14 @@ impl AuthorizeResult {
         self.inner.workload.clone().map(|v| v.into())
     }
 
-    /// Get the decision value for person/user
-    fn person(&self) -> Option<AuthorizeResultResponse> {
-        self.inner.person.clone().map(|v| v.into())
+    /// Get the decision value for user
+    fn user(&self) -> Option<AuthorizeResultResponse> {
+        self.inner.user.clone().map(|v| v.into())
+    }
+
+    /// The reason why the result was DENY in case it was because of a bad input
+    fn reason_input(&self) -> Option<String> {
+        self.inner.reason_input.as_ref().map(|e| e.to_string())
     }
 }
 

jans-cedarling/bindings/cedarling_python/src/authorize/errors.rs

@@ -18,79 +18,9 @@ create_exception!(
 
 create_exception!(
     authorize_errors,
-    DecodeTokens,
+    LoggingError,
     AuthorizeError,
-    "Error encountered while decoding JWT token data"
-);
-
-create_exception!(
-    authorize_errors,
-    ProcessTokens,
-    AuthorizeError,
-    "Error encountered while processing JWT token data"
-);
-
-create_exception!(
-    authorize_errors,
-    ActionError,
-    AuthorizeError,
-    "Error encountered while parsing Action to EntityUid"
-);
-
-create_exception!(
-    authorize_errors,
-    CreateContextError,
-    AuthorizeError,
-    "Error encountered while validating context according to the schema"
-);
-
-create_exception!(
-    authorize_errors,
-    WorkloadRequestValidationError,
-    AuthorizeError,
-    "Error encountered while creating cedar_policy::Request for workload entity principal"
-);
-
-create_exception!(
-    authorize_errors,
-    UserRequestValidationError,
-    AuthorizeError,
-    "Error encountered while creating cedar_policy::Request for user entity principal"
-);
-
-create_exception!(
-    authorize_errors,
-    EntitiesError,
-    AuthorizeError,
-    "Error encountered while collecting all entities"
-);
-
-create_exception!(
-    authorize_errors,
-    EntitiesToJsonError,
-    AuthorizeError,
-    "Error encountered while parsing all entities to json for logging"
-);
-
-create_exception!(
-    authorize_errors,
-    BuildContextError,
-    AuthorizeError,
-    "Error encountered while building the request context"
-);
-
-create_exception!(
-    authorize_errors,
-    IdTokenTrustModeError,
-    AuthorizeError,
-    "Error encountered while running on strict id token trust mode"
-);
-
-create_exception!(
-    authorize_errors,
-    BuildEntityError,
-    AuthorizeError,
-    "Error encountered while running on strict id token trust mode"
+    "Error encountered while trying to write logs"
 );
 
 #[pyclass]
@@ -131,16 +61,7 @@ macro_rules! errors_functions {
 // This function is used to convert `cedarling::AuthorizeError` to a Python exception.
 // For each possible case of `AuthorizeError`, we have created a corresponding Python exception that inherits from `cedarling::AuthorizeError`.
 errors_functions! {
-    ProcessTokens => ProcessTokens,
-    Action => ActionError,
-    CreateContext => CreateContextError,
-    WorkloadRequestValidation => WorkloadRequestValidationError,
-    UserRequestValidation => UserRequestValidationError,
-    Entities => EntitiesError,
-    EntitiesToJson => EntitiesToJsonError,
-    BuildContext => BuildContextError,
-    IdTokenTrustMode => IdTokenTrustModeError,
-    BuildEntity => BuildEntityError
+    Logging => LoggingError
 }
 
 pub fn authorize_errors_module(m: &Bound<'_, PyModule>) -> PyResult<()> {

jans-cedarling/bindings/cedarling_wasm/src/lib.rs

@@ -168,7 +168,10 @@ pub struct AuthorizeResult {
     pub workload: Option<AuthorizeResultResponse>,
     /// Result of authorization where principal is `Jans::User`
     #[wasm_bindgen(getter_with_clone)]
-    pub person: Option<AuthorizeResultResponse>,
+    pub user: Option<AuthorizeResultResponse>,
+
+    #[wasm_bindgen(getter_with_clone)]
+    pub reason_input: Option<String>,
 
     /// Result of authorization
     /// true means `ALLOW`
@@ -192,9 +195,10 @@ impl From<cedarling::AuthorizeResult> for AuthorizeResult {
             workload: value
                 .workload
                 .map(|v| AuthorizeResultResponse { inner: Rc::new(v) }),
-            person: value
-                .person
+            user: value
+                .user
                 .map(|v| AuthorizeResultResponse { inner: Rc::new(v) }),
+            reason_input: value.reason_input.as_ref().map(|x| x.to_string()),
             decision: value.decision,
         }
     }

jans-cedarling/cedarling/src/authz/authorize_result.rs

@@ -5,23 +5,29 @@
  * Copyright (c) 2024, Gluu, Inc.
  */
 
-use cedar_policy::Decision;
-use serde::ser::SerializeStruct;
-use serde::{Serialize, Serializer};
-use std::collections::HashSet;
-
+use super::BadInputError;
 use crate::bootstrap_config::WorkloadBoolOp;
+use cedar_policy::{Decision, PolicyId};
+use serde::{Serialize, Serializer, ser::SerializeStruct};
+use std::collections::HashSet;
 
 /// Result of authorization and evaluation cedar policy
 /// based on the [Request](crate::models::request::Request) and policy store
-#[derive(Debug, Clone, Serialize)]
+#[derive(Debug, Serialize)]
 pub struct AuthorizeResult {
     /// Result of authorization where principal is `Jans::Workload`
     #[serde(serialize_with = "serialize_opt_response")]
     pub workload: Option<cedar_policy::Response>,
     /// Result of authorization where principal is `Jans::User`
     #[serde(serialize_with = "serialize_opt_response")]
-    pub person: Option<cedar_policy::Response>,
+    pub user: Option<cedar_policy::Response>,
+
+    /// Reasons why the authorization failed due to malformed inputs
+    #[serde(
+        serialize_with = "serialize_reason_input",
+        skip_serializing_if = "Option::is_none"
+    )]
+    pub reason_input: Option<BadInputError>,
 
     /// Result of authorization
     /// true means `ALLOW`
@@ -66,17 +72,80 @@ where
     }
 }
 
+impl<E> From<E> for AuthorizeResult
+where
+    E: Into<BadInputError>,
+{
+    fn from(value: E) -> Self {
+        Self {
+            reason_input: Some(value.into()),
+            decision: false,
+            workload: None,
+            user: None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct PrincipalResult {
+    pub decision: Option<Decision>,
+    pub reason_input: Option<String>,
+    pub reason_policy: Option<HashSet<PolicyId>>,
+    #[serde(
+        serialize_with = "serialize_errors_policy",
+        skip_serializing_if = "Vec::is_empty"
+    )]
+    pub errors_policy: Vec<cedar_policy::AuthorizationError>,
+}
+
+impl From<cedar_policy::Response> for PrincipalResult {
+    fn from(response: cedar_policy::Response) -> Self {
+        let reason_policy = response.diagnostics().reason().cloned().collect();
+        let errors_policy = response.diagnostics().errors().cloned().collect();
+
+        Self {
+            decision: Some(response.decision()),
+            reason_input: None,
+            reason_policy: Some(reason_policy),
+            errors_policy,
+        }
+    }
+}
+
+fn serialize_reason_input<S>(
+    error: &Option<BadInputError>,
+    serializer: S,
+) -> Result<S::Ok, S::Error>
+where
+    S: Serializer,
+{
+    error.as_ref().map(|e| e.to_string()).serialize(serializer)
+}
+
+fn serialize_errors_policy<S>(
+    errors: &[cedar_policy::AuthorizationError],
+    serializer: S,
+) -> Result<S::Ok, S::Error>
+where
+    S: Serializer,
+{
+    let str_errors = errors.iter().map(|e| e.to_string()).collect::<String>();
+    str_errors.serialize(serializer)
+}
+
 impl AuthorizeResult {
     /// Builder function for AuthorizeResult
     pub(crate) fn new(
         user_workload_operator: WorkloadBoolOp,
         workload: Option<cedar_policy::Response>,
-        person: Option<cedar_policy::Response>,
+        user: Option<cedar_policy::Response>,
     ) -> Self {
+        let decision = calc_decision(user_workload_operator, &workload, &user);
         Self {
-            decision: calc_decision(&user_workload_operator, &workload, &person),
+            decision,
+            reason_input: None,
+            user,
             workload,
-            person,
         }
     }
 
@@ -98,7 +167,7 @@ impl AuthorizeResult {
 /// If person and workload is present will be used operator (AND or OR) based on `CEDARLING_USER_WORKLOAD_BOOLEAN_OPERATION` bootstrap property.
 /// If none present return false.
 fn calc_decision(
-    user_workload_operator: &WorkloadBoolOp,
+    user_workload_operator: WorkloadBoolOp,
     workload: &Option<cedar_policy::Response>,
     person: &Option<cedar_policy::Response>,
 ) -> bool {

jans-cedarling/cedarling/src/authz/entity_builder/build_user_entity.rs

@@ -53,11 +53,16 @@ impl fmt::Display for BuildUserEntityError {
         } else {
             writeln!(
                 f,
-                "failed to create User Entity due to the following errors:"
+                "failed to create User Entity due to the following errors: [{}]",
+                self.errors
+                    .iter()
+                    .map(|(tkn, err)| format!(
+                        "tried building user entity using `{}` but failed: {}",
+                        tkn, err
+                    ))
+                    .collect::<Vec<String>>()
+                    .join(", ")
             )?;
-            for (token_kind, error) in &self.errors {
-                writeln!(f, "- TokenKind {:?}: {}", token_kind, error)?;
-            }
         }
         Ok(())
     }