In and not-in operators for JSON pattern-matching

[guicassolato]

It would be nice to have in and not-in operators amongst the ones supported by Authorino's JSON pattern-matching, so values fetched from the Authorization JSON can be checked if included/not included in a particular static list, without requiring an OPA policy for that.

This is more or less the opposite of the incl and excl operations, which check if a list fetched from the Authorization JSON includes/does not include a particular static value.

[Rohith-Raju]

Hey @guicassolato, I'd like to work on this 😄

[Rohith-Raju]

Hey @guicassolato, I thought about this and here's what I came up with.

1. Add a new field in StaticList []string in JSONPatternMatchingRule.

type JSONPatternMatchingRule struct {
	Selector string
	Operator string
	Value    string
	StaticList []string
}

2. Add a new switch case operatorIn to check if values fetched from the Authorization JSON contain elements in the StaticList. Opposite can be done to out.

case operatorIn:
		exists := make(map[string]bool)
		for _, value := range expectedList {
			exists[value] = true
		}
		for _, value := range obtainedValue.Array() {
			if !exists[value.String()] {
				return false, nil
			}
		}
		return true, nil

WDYT?

[guicassolato]

@Rohith-Raju,

We can add StaticList []string to JSONPatternMatchingRule but 2 things come to mind:

1. We still need to expose this option at the level of the API, i.e.

   authorino/api/v1beta1/auth_config_types.go

   Line 170 in ee10686

   Value string `json:"value,omitempty"`

   At the API, instead of introducing a new field, I thought about changing the type of Value to runtime.RawExtension. Depending on the operator, the value could be unmarshalled as string into JSONPatternMatchingRule.Value or as []string into JSONPatternMatchingRule.StaticList.

2. Why just string and []string, I wonder. Should we change the type of JSONPatternMatchingRule.Value to any and open for other JSON types as well?

For the implementation (ignoring (2) above, thus thinking only string and []string), I think obtainedValue would be a simple string, while expectedValue would be the slice. I.e.

case operatorIn:
	for _, expectedValue := range rule.StaticList {
		if expectedValue == obtainedValue.String() {
			return true, nil
		}
	}
	return false, nil 
}

[guicassolato]

@alexsnaps, I guess we can close this in favour of #475. WDYT?

[alexsnaps]

👍