wso2 / balana

Apache License 2.0
123 stars 110 forks source link

Implement XACML3 higher order functions. (any-of, all-of and any-of-… #139

Closed senthalan closed 4 years ago

senthalan commented 4 years ago

Fix https://github.com/wso2/product-is/issues/6501

urn:oasis:names:tc:xacml:3.0:function:any-of

This function applies a Boolean function between specific primitive values and a bag of values, and SHALL return "True" if and only if the predicate is "True" for at least one element of the bag.

This function SHALL take n+1 arguments, where n is one or greater. The first argument SHALL be an element that names a Boolean function that takes n arguments of primitive types. Under the remaining n arguments, n-1 parameters SHALL be values of primitive data-types and one SHALL be a bag of a primitive data-type. The expression SHALL be evaluated as if the function named in the argument were applied to the n-1 non-bag arguments and each element of the bag argument and the results are combined with “urn:oasis:names:tc:xacml:1.0:function:or”.

urn:oasis:names:tc:xacml:3.0:function:all-of

This function applies a Boolean function between a specific primitive value and a bag of values, and returns "True" if and only if the predicate is "True" for every element of the bag.

This function SHALL take n+1 arguments, where n is one or greater. The first argument SHALL be a element that names a Boolean function that takes n arguments of primitive types. Under the remaining n arguments, n-1 parameters SHALL be values of primitive data-types and one SHALL be a bag of a primitive data-type. The expression SHALL be evaluated as if the function named in the argument were applied to the n-1 non-bag arguments and each element of the bag argument and the results are combined with “urn:oasis:names:tc:xacml:1.0:function:and”.

urn:oasis:names:tc:xacml:3.0:function:any-of-any

This function applies a Boolean function on each tuple from the cross product on all bags arguments, and returns "True" if and only if the predicate is "True" for at least one inside-function call.

This function SHALL take n+1 arguments, where n is one or greater. The first argument SHALL be an element that names a Boolean function that takes n arguments. The remaining arguments are either primitive data types or bags of primitive types. The expression SHALL be evaluated as if the function named in the argument was applied between every tuple of the cross product on all bags and the primitive values, and the results were combined using “urn:oasis:names:tc:xacml:1.0:function:or”. The semantics are that the result of the expression SHALL be "True" if and only if the applied predicate is "True" for at least one function call on the tuples from the bags and primitive values.

[1] - http://docs.oasis-open.org/xacml/3.0/xacml-3.0-core-spec-os-en.html#_Toc325047251