Method evaluate

core/station/impl/src/core/request.rs:41–98

(&self)

impl Evaluate<RequestEvaluationResult> for RequestEvaluator {
    fn evaluate(&self) -> Result<RequestEvaluationResult, EvaluateError> {
        let matching_policies = self
            .request
            .operation
            .to_resources()
            .iter()
            .flat_map(|resource| REQUEST_POLICY_REPOSITORY.find_by_resource(resource.to_owned()))
            .collect::<Vec<_>>();

        if matching_policies.is_empty() {
            // Since requests handle security critical operations, we want to reject them by default if
            // they don't match any policy. Users need to explicitly add the necessary policies to evaluate them.
            return Ok(RequestEvaluationResult {
                request_id: self.request.id,
                status: EvaluationStatus::Rejected,
                policy_results: vec![],
            });
        }

        let request = Arc::new(self.request.to_owned());
        let mut evaluation_statuses = Vec::new();

        // Evaluate all matching policies to get the full evaluation result.
        for policy in matching_policies {
            // Evaluate the request policy rule.
            let evaluation_status = self
                .policy_rule_evaluator
                .evaluate((request.to_owned(), Arc::new(policy.rule)))
                .context("failed to evaluate policy rule")?;

            evaluation_statuses.push(evaluation_status);
        }

        Ok(RequestEvaluationResult {
            request_id: self.request.id,
            status: {
                if evaluation_statuses
                    .iter()
                    .any(|result| result.status == EvaluationStatus::Approved)
                {
                    // If any policy of the request is approved, then the request is approved.
                    EvaluationStatus::Approved
                } else if evaluation_statuses
                    .iter()
                    .all(|result| result.status == EvaluationStatus::Rejected)
                {
                    // Only if all policies are rejected then the request is rejected,
                    // this applies an implicit `OR` between policies.
                    EvaluationStatus::Rejected
                } else {
                    // Since there are matching policies, but none of them approved or rejected the request, we keep it in the
                    // pending status until one of the policies evaluates it as approved or rejected.
                    EvaluationStatus::Pending
                }
            },
            policy_results: evaluation_statuses,
        })
    }