| | | 1 | | using System.Collections.ObjectModel; |
| | | 2 | | using AsiBackbone.Core.Signing; |
| | | 3 | | |
| | | 4 | | namespace AsiBackbone.Core.CapabilityTokens; |
| | | 5 | | |
| | | 6 | | public sealed class CapabilityGrantValidationResult |
| | | 7 | | { |
| | 0 | 8 | | private static readonly IReadOnlyDictionary<string, string> EmptyMetadata = |
| | 0 | 9 | | new ReadOnlyDictionary<string, string>(new Dictionary<string, string>(StringComparer.Ordinal)); |
| | | 10 | | |
| | 36 | 11 | | private CapabilityGrantValidationResult( |
| | 36 | 12 | | bool isValid, |
| | 36 | 13 | | CapabilityTokenValidationCategory category, |
| | 36 | 14 | | VerificationPolicyAction action, |
| | 36 | 15 | | string status, |
| | 36 | 16 | | string? failureCode, |
| | 36 | 17 | | string? failureMessage, |
| | 36 | 18 | | string tokenId, |
| | 36 | 19 | | IReadOnlyDictionary<string, string> safeMetadata) |
| | | 20 | | { |
| | 36 | 21 | | ArgumentException.ThrowIfNullOrWhiteSpace(status); |
| | 36 | 22 | | ArgumentException.ThrowIfNullOrWhiteSpace(tokenId); |
| | | 23 | | |
| | 36 | 24 | | if (!Enum.IsDefined(category)) |
| | | 25 | | { |
| | 0 | 26 | | throw new ArgumentOutOfRangeException(nameof(category), category, "Validation category must be defined."); |
| | | 27 | | } |
| | | 28 | | |
| | 36 | 29 | | if (!Enum.IsDefined(action)) |
| | | 30 | | { |
| | 0 | 31 | | throw new ArgumentOutOfRangeException(nameof(action), action, "Validation action must be defined."); |
| | | 32 | | } |
| | | 33 | | |
| | 36 | 34 | | IsValid = isValid; |
| | 36 | 35 | | Category = category; |
| | 36 | 36 | | Action = action; |
| | 36 | 37 | | Status = status.Trim(); |
| | 36 | 38 | | FailureCode = NormalizeOptional(failureCode); |
| | 36 | 39 | | FailureMessage = NormalizeOptional(failureMessage); |
| | 36 | 40 | | TokenId = tokenId.Trim(); |
| | 36 | 41 | | SafeMetadata = safeMetadata; |
| | 36 | 42 | | } |
| | | 43 | | |
| | 35 | 44 | | public bool IsValid { get; } |
| | | 45 | | |
| | 34 | 46 | | public CapabilityTokenValidationCategory Category { get; } |
| | | 47 | | |
| | 65 | 48 | | public VerificationPolicyAction Action { get; } |
| | | 49 | | |
| | 31 | 50 | | public bool ShouldAllow => Action is VerificationPolicyAction.Allow; |
| | | 51 | | |
| | 2 | 52 | | public string Status { get; } |
| | | 53 | | |
| | 29 | 54 | | public string? FailureCode { get; } |
| | | 55 | | |
| | 4 | 56 | | public string? FailureMessage { get; } |
| | | 57 | | |
| | 1 | 58 | | public string TokenId { get; } |
| | | 59 | | |
| | 11 | 60 | | public IReadOnlyDictionary<string, string> SafeMetadata { get; } |
| | | 61 | | |
| | | 62 | | public static CapabilityGrantValidationResult Valid(CapabilityTokenGrant grant) |
| | | 63 | | { |
| | 5 | 64 | | ArgumentNullException.ThrowIfNull(grant); |
| | | 65 | | |
| | 4 | 66 | | return new CapabilityGrantValidationResult( |
| | 4 | 67 | | true, |
| | 4 | 68 | | CapabilityTokenValidationCategory.Valid, |
| | 4 | 69 | | VerificationPolicyAction.Allow, |
| | 4 | 70 | | "Valid", |
| | 4 | 71 | | null, |
| | 4 | 72 | | null, |
| | 4 | 73 | | grant.TokenId, |
| | 4 | 74 | | BuildSafeMetadata(grant, CapabilityTokenValidationCategory.Valid, VerificationPolicyAction.Allow, null)); |
| | | 75 | | } |
| | | 76 | | |
| | | 77 | | public static CapabilityGrantValidationResult Failed( |
| | | 78 | | CapabilityTokenGrant grant, |
| | | 79 | | CapabilityTokenValidationCategory category, |
| | | 80 | | VerificationPolicyAction action, |
| | | 81 | | string failureCode, |
| | | 82 | | string? failureMessage = null) |
| | | 83 | | { |
| | 34 | 84 | | ArgumentNullException.ThrowIfNull(grant); |
| | 33 | 85 | | ArgumentException.ThrowIfNullOrWhiteSpace(failureCode); |
| | | 86 | | |
| | 32 | 87 | | return new CapabilityGrantValidationResult( |
| | 32 | 88 | | false, |
| | 32 | 89 | | category, |
| | 32 | 90 | | action, |
| | 32 | 91 | | "Failed", |
| | 32 | 92 | | failureCode, |
| | 32 | 93 | | failureMessage, |
| | 32 | 94 | | grant.TokenId, |
| | 32 | 95 | | BuildSafeMetadata(grant, category, action, failureCode)); |
| | | 96 | | } |
| | | 97 | | |
| | | 98 | | private static IReadOnlyDictionary<string, string> BuildSafeMetadata( |
| | | 99 | | CapabilityTokenGrant grant, |
| | | 100 | | CapabilityTokenValidationCategory category, |
| | | 101 | | VerificationPolicyAction action, |
| | | 102 | | string? failureCode) |
| | | 103 | | { |
| | 36 | 104 | | Dictionary<string, string> metadata = new(StringComparer.Ordinal) |
| | 36 | 105 | | { |
| | 36 | 106 | | ["audience"] = grant.Audience, |
| | 36 | 107 | | ["category"] = category.ToString(), |
| | 36 | 108 | | ["grant_id"] = grant.TokenId, |
| | 36 | 109 | | ["issuer"] = grant.Issuer, |
| | 36 | 110 | | ["policy_action"] = action.ToString() |
| | 36 | 111 | | }; |
| | | 112 | | |
| | 36 | 113 | | AddIfPresent(metadata, "acknowledgment_id", grant.AcknowledgmentId); |
| | 36 | 114 | | AddIfPresent(metadata, "failure_code", failureCode); |
| | 36 | 115 | | AddIfPresent(metadata, "handshake_id", grant.HandshakeId); |
| | 36 | 116 | | AddIfPresent(metadata, "policy_hash", grant.PolicyHash); |
| | 36 | 117 | | AddIfPresent(metadata, "policy_version", grant.PolicyVersion); |
| | 36 | 118 | | AddIfPresent(metadata, "resource_binding", grant.ResourceBinding); |
| | | 119 | | |
| | 36 | 120 | | return metadata.Count == 0 |
| | 36 | 121 | | ? EmptyMetadata |
| | 36 | 122 | | : new ReadOnlyDictionary<string, string>(metadata); |
| | | 123 | | } |
| | | 124 | | |
| | | 125 | | private static void AddIfPresent(Dictionary<string, string> metadata, string key, string? value) |
| | | 126 | | { |
| | 216 | 127 | | if (!string.IsNullOrWhiteSpace(value)) |
| | | 128 | | { |
| | 206 | 129 | | metadata[key] = value.Trim(); |
| | | 130 | | } |
| | 216 | 131 | | } |
| | | 132 | | |
| | | 133 | | private static string? NormalizeOptional(string? value) |
| | | 134 | | { |
| | 72 | 135 | | return string.IsNullOrWhiteSpace(value) ? null : value.Trim(); |
| | | 136 | | } |
| | | 137 | | } |