[RORDEV-1388] New sytax of groups rules, refactor and common decoder

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/BlockContext.scala

@@ -23,7 +23,7 @@ import tech.beshu.ror.accesscontrol.blocks.BlockContextUpdater.*
 import tech.beshu.ror.accesscontrol.blocks.metadata.UserMetadata
 import tech.beshu.ror.accesscontrol.domain.*
 import tech.beshu.ror.accesscontrol.domain.FieldLevelSecurity.RequestFieldsUsage
-import tech.beshu.ror.accesscontrol.domain.GroupsLogic.{CombinedGroupsLogic, NegativeGroupsLogic, PositiveGroupsLogic}
+import tech.beshu.ror.accesscontrol.domain.GroupsLogic.{Combined, NegativeGroupsLogic, PositiveGroupsLogic}
 import tech.beshu.ror.accesscontrol.request.RequestContext
 import tech.beshu.ror.syntax.*
 
@@ -54,7 +54,7 @@ sealed trait BlockContext {
         true
       case logic: PositiveGroupsLogic =>
         isCurrentGroupEligible(logic.permittedGroupIds)
-      case logic: CombinedGroupsLogic =>
+      case logic: Combined =>
         isCurrentGroupEligible(logic.positiveGroupsLogic.permittedGroupIds)
     }
   }

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/ImpersonationWarning.scala

@@ -30,7 +30,8 @@ import tech.beshu.ror.accesscontrol.blocks.rules.elasticsearch.indices.IndicesRu
 import tech.beshu.ror.accesscontrol.blocks.rules.http.*
 import tech.beshu.ror.accesscontrol.blocks.rules.kibana.*
 import tech.beshu.ror.accesscontrol.blocks.rules.tranport.{HostsRule, LocalHostsRule}
-import tech.beshu.ror.accesscontrol.domain.RequestId
+import tech.beshu.ror.accesscontrol.domain.GroupsLogic.*
+import tech.beshu.ror.accesscontrol.domain.{GroupsLogic, RequestId}
 import tech.beshu.ror.implicits.*
 import tech.beshu.ror.utils.RefinedUtils.*
 
@@ -130,10 +131,7 @@ object ImpersonationWarning {
         }
       } yield warning
     )
-    implicit val groupsOrRule: ImpersonationWarningExtractor[GroupsOrRule] = noWarnings[GroupsOrRule]
-    implicit val groupsAndRule: ImpersonationWarningExtractor[GroupsAndRule] = noWarnings[GroupsAndRule]
-    implicit val groupsNotAllOfRule: ImpersonationWarningExtractor[GroupsNotAllOfRule] = noWarnings[GroupsNotAllOfRule]
-    implicit val groupsNotAnyOfRule: ImpersonationWarningExtractor[GroupsNotAnyOfRule] = noWarnings[GroupsNotAnyOfRule]
+    implicit def groupsRule[GL <: GroupsLogic]: ImpersonationWarningExtractor[GroupsRule[GL]] = noWarnings[GroupsRule[GL]]
     implicit val jwtAuthRule: ImpersonationWarningExtractor[JwtAuthRule] = ImpersonationWarningExtractor[JwtAuthRule] { (rule, blockName, _) =>
       Some(impersonationNotSupportedWarning(rule, blockName))
     }

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/RuleOrdering.scala

@@ -26,6 +26,7 @@ import tech.beshu.ror.accesscontrol.blocks.rules.elasticsearch.indices.*
 import tech.beshu.ror.accesscontrol.blocks.rules.http.*
 import tech.beshu.ror.accesscontrol.blocks.rules.kibana.*
 import tech.beshu.ror.accesscontrol.blocks.rules.tranport.*
+import tech.beshu.ror.accesscontrol.domain.GroupsLogic.*
 import tech.beshu.ror.accesscontrol.orders.*
 
 class RuleOrdering extends Ordering[Rule] with Logging {
@@ -65,8 +66,11 @@ object RuleOrdering {
     classOf[LdapAuthRule],
     classOf[LdapAuthenticationRule],
     classOf[ExternalAuthenticationRule],
-    classOf[GroupsOrRule],
-    classOf[GroupsAndRule],
+    classOf[AnyOfGroupsRule],
+    classOf[AllOfGroupsRule],
+    classOf[NotAnyOfGroupsRule],
+    classOf[NotAllOfGroupsRule],
+    classOf[CombinedGroupsRule],
     // all authorization rules should be placed after any authentication rule
     classOf[LdapAuthorizationRule],
     classOf[ExternalAuthorizationRule],

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/BaseGroupsRule.scala → core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/GroupsRule.scala

@@ -23,10 +23,10 @@ import tech.beshu.ror.accesscontrol.blocks.definitions.UserDef
 import tech.beshu.ror.accesscontrol.blocks.definitions.UserDef.Mode.WithGroupsMapping.Auth
 import tech.beshu.ror.accesscontrol.blocks.definitions.UserDef.{GroupMappings, Mode}
 import tech.beshu.ror.accesscontrol.blocks.rules.Rule
+import tech.beshu.ror.accesscontrol.blocks.rules.Rule.*
 import tech.beshu.ror.accesscontrol.blocks.rules.Rule.AuthenticationRule.EligibleUsersSupport
 import tech.beshu.ror.accesscontrol.blocks.rules.Rule.RuleResult.{Fulfilled, Rejected}
-import tech.beshu.ror.accesscontrol.blocks.rules.Rule.{AuthRule, AuthenticationRule, AuthorizationRule, RuleResult}
-import tech.beshu.ror.accesscontrol.blocks.rules.auth.BaseGroupsRule.Settings
+import tech.beshu.ror.accesscontrol.blocks.rules.auth.GroupsRule.Settings
 import tech.beshu.ror.accesscontrol.blocks.rules.auth.base.impersonation.{AuthenticationImpersonationCustomSupport, AuthorizationImpersonationCustomSupport}
 import tech.beshu.ror.accesscontrol.blocks.variables.runtime.RuntimeResolvableGroupsLogic
 import tech.beshu.ror.accesscontrol.blocks.{BlockContext, BlockContextUpdater}
@@ -35,7 +35,29 @@ import tech.beshu.ror.accesscontrol.matchers.GenericPatternMatcher
 import tech.beshu.ror.implicits.*
 import tech.beshu.ror.utils.uniquelist.{UniqueList, UniqueNonEmptyList}
 
-abstract class BaseGroupsRule[GL <: GroupsLogic](val settings: Settings[GL])
+class AnyOfGroupsRule(override val name: Rule.Name, override val settings: Settings[GroupsLogic.AnyOf])
+                     (override implicit val userIdCaseSensitivity: CaseSensitivity)
+  extends GroupsRule[GroupsLogic.AnyOf](name, settings)
+
+class AllOfGroupsRule(override val name: Rule.Name, override val settings: Settings[GroupsLogic.AllOf])
+                     (override implicit val userIdCaseSensitivity: CaseSensitivity)
+  extends GroupsRule[GroupsLogic.AllOf](name, settings)
+
+class NotAnyOfGroupsRule(override val name: Rule.Name, override val settings: Settings[GroupsLogic.NotAnyOf])
+                        (override implicit val userIdCaseSensitivity: CaseSensitivity)
+  extends GroupsRule[GroupsLogic.NotAnyOf](name, settings)
+
+class NotAllOfGroupsRule(override val name: Rule.Name, override val settings: Settings[GroupsLogic.NotAllOf])
+                        (override implicit val userIdCaseSensitivity: CaseSensitivity)
+  extends GroupsRule[GroupsLogic.NotAllOf](name, settings)
+
+class CombinedGroupsRule(override val name: Rule.Name, override val settings: Settings[GroupsLogic.Combined])
+                        (override implicit val userIdCaseSensitivity: CaseSensitivity)
+  extends GroupsRule[GroupsLogic.Combined](name, settings)
+
+abstract class GroupsRule[+GL <: GroupsLogic](override val name: Rule.Name,
+                                              val settings: Settings[GL])
+                                             (override implicit val userIdCaseSensitivity: CaseSensitivity)
   extends AuthRule
     with AuthenticationImpersonationCustomSupport
     with AuthorizationImpersonationCustomSupport
@@ -287,7 +309,29 @@ abstract class BaseGroupsRule[GL <: GroupsLogic](val settings: Settings[GL])
   }
 }
 
-object BaseGroupsRule {
-  final case class Settings[GL <: GroupsLogic](permittedGroupsLogic: RuntimeResolvableGroupsLogic[GL],
-                                               usersDefinitions: NonEmptyList[UserDef])
+object GroupsRule {
+
+  def name(ruleName: String): RuleName[GroupsRule[GroupsLogic]] = new RuleName[GroupsRule[GroupsLogic]] {
+    override val name: Rule.Name = Rule.Name(ruleName)
+  }
+
+  final case class Settings[+GL <: GroupsLogic](permittedGroupsLogic: RuntimeResolvableGroupsLogic[GL],
+                                                usersDefinitions: NonEmptyList[UserDef])
+
+  trait Creator[GL <: GroupsLogic] {
+    def create(name: Rule.Name,
+               settings: Settings[GL],
+               userIdCaseSensitivity: CaseSensitivity): GroupsRule[GL]
+  }
+
+  object Creator {
+    implicit val allOfTypeInfo: Creator[GroupsLogic.AllOf] = new AllOfGroupsRule(_, _)(_)
+    implicit val anyOfTypeInfo: Creator[GroupsLogic.AnyOf] = new AnyOfGroupsRule(_, _)(_)
+    implicit val notAllOfTypeInfo: Creator[GroupsLogic.NotAllOf] = new NotAllOfGroupsRule(_, _)(_)
+    implicit val notAnyOfTypeInfo: Creator[GroupsLogic.NotAnyOf] = new NotAnyOfGroupsRule(_, _)(_)
+    implicit val combinedTypeInfo: Creator[GroupsLogic.Combined] = new CombinedGroupsRule(_, _)(_)
+
+    def apply[GL <: GroupsLogic](implicit creator: Creator[GL]): Creator[GL] = creator
+  }
+
 }

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/LdapAuthorizationRule.scala

@@ -100,6 +100,6 @@ object LdapAuthorizationRule {
                                                  groupsLogic: GroupsLogic.PositiveGroupsLogic) extends Settings
 
     final case class CombinedGroupsLogicSettings(ldap: LdapAuthorizationService,
-                                                 groupsLogic: GroupsLogic.CombinedGroupsLogic) extends Settings
+                                                 groupsLogic: GroupsLogic.Combined) extends Settings
   }
 }

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/users/LocalUsersContext.scala

@@ -28,7 +28,8 @@ import tech.beshu.ror.accesscontrol.blocks.rules.http.*
 import tech.beshu.ror.accesscontrol.blocks.rules.kibana.*
 import tech.beshu.ror.accesscontrol.blocks.rules.tranport.*
 import tech.beshu.ror.accesscontrol.blocks.variables.runtime.RuntimeMultiResolvableVariable
-import tech.beshu.ror.accesscontrol.domain.LocalUsers
+import tech.beshu.ror.accesscontrol.domain.GroupsLogic.*
+import tech.beshu.ror.accesscontrol.domain.{GroupsLogic, LocalUsers}
 import tech.beshu.ror.syntax.*
 
 object LocalUsersContext {
@@ -53,10 +54,7 @@ object LocalUsersContext {
     implicit val externalAuthorizationRule: LocalUsersSupport[ExternalAuthorizationRule] = NotAvailableLocalUsers()
     implicit val fieldsRule: LocalUsersSupport[FieldsRule] = NotAvailableLocalUsers()
     implicit val filterRule: LocalUsersSupport[FilterRule] = NotAvailableLocalUsers()
-    implicit val groupsOrRule: LocalUsersSupport[GroupsOrRule] = NotAvailableLocalUsers()
-    implicit val groupsAndRule: LocalUsersSupport[GroupsAndRule] = NotAvailableLocalUsers()
-    implicit val groupsNotAnyOfRule: LocalUsersSupport[GroupsNotAnyOfRule] = NotAvailableLocalUsers()
-    implicit val groupsNotAllOfRule: LocalUsersSupport[GroupsNotAllOfRule] = NotAvailableLocalUsers()
+    implicit def groupsRule[GL <: GroupsLogic]: LocalUsersSupport[GroupsRule[GL]] = NotAvailableLocalUsers()
     implicit val headersAndRule: LocalUsersSupport[HeadersAndRule] = NotAvailableLocalUsers()
     implicit val headersOrRule: LocalUsersSupport[HeadersOrRule] = NotAvailableLocalUsers()
     implicit val hostsRule: LocalUsersSupport[HostsRule] = NotAvailableLocalUsers()

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/variables/runtime/RuntimeResolvableGroupsLogic.scala

@@ -18,18 +18,42 @@ package tech.beshu.ror.accesscontrol.blocks.variables.runtime
 
 import cats.data.NonEmptyList
 import tech.beshu.ror.accesscontrol.blocks.BlockContext
+import tech.beshu.ror.accesscontrol.domain.GroupsLogic.{NegativeGroupsLogic, PositiveGroupsLogic}
 import tech.beshu.ror.accesscontrol.domain.{GroupIdLike, GroupIds, GroupsLogic}
 import tech.beshu.ror.accesscontrol.utils.RuntimeMultiResolvableVariableOps.resolveAll
 import tech.beshu.ror.utils.uniquelist.UniqueNonEmptyList
 
-class RuntimeResolvableGroupsLogic[GL <: GroupsLogic](val groupIds: UniqueNonEmptyList[RuntimeMultiResolvableVariable[GroupIdLike]],
-                                                      creator: GroupIds => GL) {
-  def resolve[B <: BlockContext](blockContext: B): Option[GL] = {
-    UniqueNonEmptyList
-      .from(resolveAll(groupIds.toNonEmptyList, blockContext))
-      .map(GroupIds.apply)
-      .map(creator)
+trait RuntimeResolvableGroupsLogic[+GL <: GroupsLogic] {
+  def resolve[B <: BlockContext](blockContext: B): Option[GL]
+
+  def usedVariables: NonEmptyList[RuntimeMultiResolvableVariable[GroupIdLike]]
+}
+
+object RuntimeResolvableGroupsLogic {
+
+  type RESOLVABLE_GROUP_IDS = UniqueNonEmptyList[RuntimeMultiResolvableVariable[GroupIdLike]]
+
+  final class Simple[+GL <: GroupsLogic : GroupsLogic.Creator](val groupIds: RESOLVABLE_GROUP_IDS) extends RuntimeResolvableGroupsLogic[GL] {
+    override def resolve[B <: BlockContext](blockContext: B): Option[GL] = {
+      UniqueNonEmptyList
+        .from(resolveAll(groupIds.toNonEmptyList, blockContext))
+        .map(GroupIds.apply)
+        .map(GroupsLogic.Creator[GL].create)
+    }
+
+    override def usedVariables: NonEmptyList[RuntimeMultiResolvableVariable[GroupIdLike]] = groupIds.toNonEmptyList
   }
 
-  def usedVariables: NonEmptyList[RuntimeMultiResolvableVariable[GroupIdLike]] = groupIds.toNonEmptyList
-}
+  final class Combined(val positive: RuntimeResolvableGroupsLogic[PositiveGroupsLogic],
+                       val negative: RuntimeResolvableGroupsLogic[NegativeGroupsLogic]) extends RuntimeResolvableGroupsLogic[GroupsLogic.Combined] {
+    override def resolve[B <: BlockContext](blockContext: B): Option[GroupsLogic.Combined] = {
+      for {
+        permitted <- positive.resolve(blockContext)
+        forbidden <- negative.resolve(blockContext)
+      } yield GroupsLogic.Combined(permitted, forbidden)
+    }
+
+    override def usedVariables: NonEmptyList[RuntimeMultiResolvableVariable[GroupIdLike]] =
+      positive.usedVariables ::: negative.usedVariables
+  }
+}