* Add set conversion helper for generic_oidc predicate expressions
This adds a small enhanced version of `set()` for generic_oidc that
can convert lists to sets.
This is needed because almost all interesting functions in the
predicate language operate on sets, not lists. So, when given `[]any`
parsed from JSON claims, they fail. This limitation affects:
- `contains()`, `contains_any()`, `contains_all()`
- `regexp.match()`
- `is_empty()`
- ...and every other function that claims to operate on `[]string`
according to the public docs but actually operates on sets.
I just created a tiny override that defers to a new
`expression.NewFlattenedSet()` constructor. It lets us (or others)
easily override the built-in `set()` impl that only accepts variadic
`string...` with this better variant, without potentially causing
unexpected changes that might, for example, cause expressions to
allow access that were previously broken due to this limitation.
* Fix failing test
* Fix imports
* Use bool as parser's generic param instead of any
Removes an unnecessary cast.
* Added support for 'regexp.match' condition for AccessMonitoringRule
* Updated AccessMonitoringRule and Predicate Language reference docs with support for regexp.match conditions; added additional condition tests
* Reduce the number of custom set implementations
* Move set to a dedicated package
lib/utils is a large package and we don't want to force all packages
that need a set to import everything else in there.
A small alias remains in lib/utils to avoid breakign teleport.e.
* Fix tests
Some tests were depending on sorted elements, others cared about
the difference between a nil slice and a non-nil but empty slice.
* Adds Generic Set type to `utils`
This patch adds a generic set type to the `utils` package, providing
utility methods and a friendlier syntax for the common Go pattern of
modelling a set of `T` as a `map[T]struct{}`.
While having a common implemntation of set operations like `intersection`
is useful, the main motivation for this change is readability. For example,
declaring a `Set[T]` signals the intent of the author much more clearly
than declaring a `map[T]struct{}`.
* Replace Set.AddAll() with variadic Set.Add()
* Made Remove variadic to match Add()
* Removed obsolete test, added test for Remove()
* Rewrites expression.Set in terms of utils.Set[T] (#47375)
Refactors the Set type in the `expression` package to use `utils.Set[T]` as
the underlying implementations. The `expression.Set` type still exists in
order to implement `expression`-specific interfaces.
* Add initial condition parser for access monitoring rules
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Check previously unchecked error and minor refactor of AMR
* Simplify check for applicable access monitoring rules
* Refactor access monitoring rules plugin integration
* Fix formating and move lock aquisition
* Add methods for listing access monitoring rules with a filter
* Add contains_any predicate expression func
* Add in is_empty func to predicate expression
* Lock AMR cache in plugins while getting initial rules
* Add in check for access monitoring rule version
* Update integrations/access/accessrequest/app.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Update integrations/access/accessrequest/app.go
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
* Move lock so it doesnt persist over api calls
* Remove unused constant and add more context to logs
* Appease linter
* Update access monitoring rules tests to pass rule validation
* Add in missing access monitoring rules list with filter code
* Appease linter
* Add back validation code for AMRs
* Fix test plugin role and rename listaccessmonitoringrulewithfilter
* Fix local test for AMR crud operations
* Fix end range for listing rules
* Fix unwrapping of resource153 event for monitoring rules
* Refactor AMR cache init into helper function in plugin app
* Add seperate response type for listAccessMonitoringRulesWithfilter
* Add context to log for plugins failing to fetch recipients
* Grab access monitoring rules cache under lock all at once
* Add clarification for which fields are optional in listAMRfilter req
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Update integrations/access/accessrequest/app.go
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
* Add forEach to common recipient set
* Move type check to after AMR event op switch
* Move turn some default parser spec methods to funcs
* Make some predicate func usable as methods as well
* Add len func to common recipient sets
* Add integration test for access monitoring rule and slack plugin
* Fix error types and messages when handling AMRs
* Use generic list resource with filter for AMR
* Add test for generic listResourceWithFilter
* Update listResourceWithFilter to use revision instead of id
* Update generic tests to use revision instead of id
* Fix linting
---------
Co-authored-by: Zac Bergquist <zac.bergquist@goteleport.com>
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Provides an opt-in mechanism to allow parsers to support dynamically
resolving variables at runtime. While this defeats some of the
static compile type benefits that typical guarantees, it is required
to allow existing parsers to be converted to use typical.
The existing resource parsers allow searching for variabls by their
fully qualified path. For example, the hostname of a server may
be quiered via `resource.spec.hostname`. In order to support this
typical could use some reflection to automatically add variables
to every nested field but that would be complicated and expensive.
Instead the ParserSpec can now be configured with
`GetUnknownIdentifier`, which allows creators of the parsers to
have full control over how a dynamic variable is resolved. The
parser prevents any dynamic resolution if the value is not configured
to limit the unsafe behvior to only parsers that explicitly opt in.
* Copy expression package out of /e
* Add doc string for default parser spec.
* Add more info to default parser spec doc string
* Fix typo in doc string
* Add missing comments including license info
Tim Buckley