policy.js revision 245d622535c32563b59ef5027b1171167ba9b451
/*! @license
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
*
* Copyright (c) 2012 ForgeRock AS. All Rights Reserved
*
* The contents of this file are subject to the terms
* of the Common Development and Distribution License
* (the License). You may not use this file except in
* compliance with the License.
*
* You can obtain a copy of the License at
* See the License for the specific language governing
* permission and limitations under the License.
*
* When distributing Covered Code, include this CDDL
* Header Notice in each file and include the License file
* If applicable, add the following below the CDDL Header,
* with the fields enclosed by brackets [] replaced by
* your own identifying information:
* "Portions Copyrighted [year] [name of copyright owner]"
*/
var returnObject = {};
var failedPolicies = new Array();
var policyConfig = {
"policies" : [
{ "policyId" : "required",
"policyExec" : "required",
"clientValidation": true,
"policyRequirements" : ["REQUIRED"]
},
{ "policyId" : "not-empty",
"policyExec" : "notEmpty",
"clientValidation": true,
"policyRequirements" : ["REQUIRED"]
},
{
"policyId" : "max-attempts-triggers-lock-cooldown",
"policyExec" : "maxAttemptsTriggersLockCooldown",
"policyRequirements" : ["NO_MORE_THAN_X_ATTEMPTS_WITHIN_Y_MINUTES"]
},
{ "policyId" : "unique",
"policyExec" : "unique",
"policyRequirements" : ["UNIQUE"]
},
{ "policyId" : "no-internal-user-conflict",
"policyExec" : "noInternalUserConflict",
"policyRequirements" : ["UNIQUE"]
},
{
"policyId" : "valid-date",
"policyExec" : "validDate",
"clientValidation": true,
"validateOnlyIfPresent": true,
"policyRequirements": ["VALID_DATE"]
},
{
"policyId" : "valid-email-address-format",
"policyExec" : "validEmailAddressFormat",
"clientValidation": true,
"validateOnlyIfPresent": true,
"policyRequirements": ["VALID_EMAIL_ADDRESS_FORMAT"]
},
{
"policyId" : "valid-name-format",
"policyExec" : "validNameFormat",
"clientValidation": true,
"validateOnlyIfPresent": true,
"policyRequirements": ["VALID_NAME_FORMAT"]
},
{
"policyId" : "valid-phone-format",
"policyExec" : "validPhoneFormat",
"clientValidation": true,
"validateOnlyIfPresent": true,
"policyRequirements": ["VALID_PHONE_FORMAT"]
},
{ "policyId" : "at-least-X-capitals",
"policyExec" : "atLeastXCapitalLetters",
"clientValidation": true,
"validateOnlyIfPresent": true,
"policyRequirements" : ["AT_LEAST_X_CAPITAL_LETTERS"]
},
{ "policyId" : "at-least-X-numbers",
"policyExec" : "atLeastXNumbers",
"clientValidation": true,
"validateOnlyIfPresent": true,
"policyRequirements" : ["AT_LEAST_X_NUMBERS"]
},
{ "policyId" : "minimum-length",
"policyExec" : "minLength",
"clientValidation": true,
"validateOnlyIfPresent": true,
"policyRequirements" : ["MIN_LENGTH"]
},
{ "policyId" : "cannot-contain-others",
"policyExec" : "cannotContainOthers",
"clientValidation": true,
"validateOnlyIfPresent": true,
"policyRequirements" : ["CANNOT_CONTAIN_OTHERS"]
},
{ "policyId" : "cannot-contain-characters",
"policyExec" : "cannotContainCharacters",
"clientValidation": true,
"validateOnlyIfPresent": true,
"policyRequirements" : ["CANNOT_CONTAIN_CHARACTERS"]
},
{
"policyId" : "required-if-configured",
"policyExec": "requiredIfConfigured",
"policyRequirements" : ["REQUIRED"]
},
{ "policyId" : "re-auth-required",
"policyExec" : "reauthRequired",
"validateOnlyIfPresent": true,
"policyRequirements" : ["REAUTH_REQUIRED"]
}
]
};
return [ { "policyRequirement" : "REQUIRED" } ];
}
return [];
}
return [ {"policyRequirement": "REQUIRED"}];
else
return [];
}
var failures = [],
failures = [{"policyRequirement": "NO_MORE_THAN_X_ATTEMPTS_WITHIN_Y_MINUTES", params: {"max":params.max,"numMinutes":params.numMinutes}}];
}
return failures;
}
var queryParams = {
"_queryId": "credential-internaluser-query",
"username": value
},
}
return [{"policyRequirement": "UNIQUE"}];
}
}
return [];
}
var queryParams = {
"_queryId": "get-by-field-value",
"field": property,
"value": value
},
{
}
return [{"policyRequirement": "UNIQUE"}];
}
}
return [];
}
return [ {"policyRequirement": "VALID_DATE"}];
} else {
return [];
}
}
var i,
join = function (arr, d) { // my own join needed since it appears params.forbiddenChars is not a proper JS array with the normal join method available
var j,list = "";
for (j in arr) {
}
};
for (i in params.forbiddenChars) {
return [ { "policyRequirement" : "CANNOT_CONTAIN_CHARACTERS", "params" : {"forbiddenChars" : join(params.forbiddenChars, ", ")} } ];
}
}
}
return [];
}
return [ {"policyRequirement": "VALID_PHONE_FORMAT"}];
} else {
return [];
}
}
var namePattern = /^([A-Za'-\u0105\u0107\u0119\u0142\u00F3\u015B\u017C\u017A\u0104\u0106\u0118\u0141\u00D3\u015A\u017B\u0179\u00C0\u00C8\u00CC\u00D2\u00D9\u00E0\u00E8\u00EC\u00F2\u00F9\u00C1\u00C9\u00CD\u00D3\u00DA\u00DD\u00E1\u00E9\u00ED\u00F3\u00FA\u00FD\u00C2\u00CA\u00CE\u00D4\u00DB\u00E2\u00EA\u00EE\u00F4\u00FB\u00C3\u00D1\u00D5\u00E3\u00F1\u00F5\u00C4\u00CB\u00CF\u00D6\u00DC\u0178\u00E4\u00EB\u00EF\u00F6\u00FC\u0178\u00A1\u00BF\u00E7\u00C7\u0152\u0153\u00DF\u00D8\u00F8\u00C5\u00E5\u00C6\u00E6\u00DE\u00FE\u00D0\u00F0\-\s])+$/;
if (typeof(value) !== "string" || !value.length || !namePattern.test(value)) {
return [ {"policyRequirement": "VALID_NAME_FORMAT"}];
} else {
return [];
}
}
function minLength(fullObject, value, params, property) {
var minLength = params.minLength;
if (typeof(value) !== "string" || !value.length || value.length < minLength) {
return [ { "policyRequirement" : "MIN_LENGTH", "params" : {"minLength":minLength} } ];
} else {
return [];
}
}
function atLeastXCapitalLetters(fullObject, value, params, property) {
var reg = /[(A-Z)]/g;
if (typeof(value) !== "string" || !value.length || value.match(reg) === null || value.match(reg).length < params.numCaps) {
return [ { "policyRequirement" : "AT_LEAST_X_CAPITAL_LETTERS", "params" : {"numCaps": params.numCaps} } ];
} else {
return [];
}
}
function atLeastXNumbers(fullObject, value, params, property) {
var reg = /\d/g;
if (typeof(value) !== "string" || !value.length || value.match(reg) === null || value.match(reg).length < params.numNums) {
return [ { "policyRequirement" : "AT_LEAST_X_NUMBERS", "params" : {"numNums": params.numNums} } ];
} else {
return [];
}
}
function validEmailAddressFormat(fullObject, value, params, property) {
var emailPattern = /^([A-Za-z0-9_\-\.])+\@([A-Za-z0-9_\-\.])+\.([A-Za-z]{2,4})$/;
if (typeof(value) !== "string" || !value.length || !emailPattern.test(value)) {
return [ {"policyRequirement": "VALID_EMAIL_ADDRESS_FORMAT"}];
} else {
return [];
}
}
function cannotContainOthers(fullObject, value, params, property) {
var fieldArray = params.disallowedFields.split(","),
fullObject_server = {};
if (typeof(openidm) !== "undefined" && typeof(request) !== "undefined" && request.id && !request.id.match('/$')) {
fullObject_server = openidm.read(request.id)
}
if (value && typeof(value) === "string" && value.length) {
for (var i = 0; i < fieldArray.length; i++) {
if (typeof(fullObject[fieldArray[i]]) === "undefined" && typeof(fullObject_server[fieldArray[i]]) !== "undefined") {
fullObject[fieldArray[i]] = fullObject_server[fieldArray[i]];
}
if (typeof(fullObject[fieldArray[i]]) === "string" && value.match(fullObject[fieldArray[i]]))
return [{"policyRequirement": "CANNOT_CONTAIN_OTHERS", params: {"disallowedFields": fieldArray[i]}}];
}
}
return [];
}
function requiredIfConfigured(fullObject, value, params, property) {
var currentValue = openidm.read("config/" + params.configBase),
baseKeyArray = params.baseKey.split("."),
caller = request.params._caller,
roles,parent,i,j,role;
parent = request;
while (!parent.security || !parent.security["openidm-roles"]) {
i++;
if(!parent.parent) {
break;
}
parent = parent.parent;
}
if (parent.security) {
roles = parent.security["openidm-roles"];
if (params && params.exceptRoles) {
for (i = 0; i < params.exceptRoles.length; i++) {
role = params.exceptRoles[i];
if (roles) {
for (j = 0; j < roles.length; j++) {
if (role === roles[j]) {
return [];
}
}
}
}
}
}
for (var i in baseKeyArray)
currentValue = currentValue[baseKeyArray[i]];
if (currentValue && (!value || !value.length))
return [ {"policyRequirement": "REQUIRED"}];
else
return [];
}
function reauthRequired(fullObject, value, params, propName) {
var exceptRoles, parent, type, roles, caller, i, j, currentObject;
caller = request.params._caller;
parent = request.parent;
if (caller && caller == "filterEnforcer") {
parent = request.parent.parent;
}
if (parent.security) {
roles = parent.security["openidm-roles"];
if (params && params.exceptRoles) {
exceptRoles = params.exceptRoles;
if (exceptRoles) {
for (i = 0; i < exceptRoles.length; i++) {
var role = exceptRoles[i];
if (roles) {
for (j = 0; j < roles.length; j++) {
if (role === roles[j]) {
return [];
}
}
}
}
}
}
}
var isHttp = request._isDirectHttp;
if (isHttp == "true" || isHttp == true) {
if (request.id && !request.id.match('/$')) {
// only do a read if there is no id specified, in the case of new records
currentObject = openidm.read(request.id);
if (openidm.isEncrypted(currentObject[propName])) {
currentObject[propName] = openidm.decrypt(currentObject[propName]);
}
if (currentObject[propName] === fullObject[propName]) {
return [];
}
}
try {
var actionParams = {
"_action": "reauthenticate"
};
var response = openidm.action("authentication", actionParams);
} catch (error) {
return [ { "policyRequirement" : "REAUTH_REQUIRED" } ];
}
}
return [];
}
// End of policy enforcement functions
// Internal policy code below
function addPolicy(policy) {
policyConfig.policies.push(policy);
}
function getPolicy(policyId) {
for (var i = 0; i < policyConfig.policies.length; i++) {
if (policyConfig.policies[i].policyId == policyId) {
return policyConfig.policies[i];
}
}
return null;
}
function getPropertyValue(requestObject, propName) {
var propAddress = propName.split("/");
var tmpObject = requestObject;
for (var i = 0; i < propAddress.length; i++) {
tmpObject = tmpObject[propAddress[i]];
if (tmpObject === undefined || tmpObject === null) {
return tmpObject;
}
}
return tmpObject;
}
function getPropertyConfig(resource, propName) {
var props = resource.properties;
for (var i = 0; i < props.length; i++) {
prop = props[i];
if (prop.name == propName) {
return prop;
}
}
return null;
}
function getResource(resources, resourceName) {
if (resources != null) {
for (var i = 0; i < resources.length; i++) {
var resource = resources[i];
if (resourceMatches(resource.resource, resourceName)) {
return resource;
}
}
}
return null;
}
function resourceMatches(resource1, resource2) {
rsrc1 = resource1.split("/");
rsrc2 = resource2.split("/");
if (rsrc1.length == rsrc2.length) {
for (var i = 0; i < rsrc1.length; i++) {
if (rsrc1[i] != rsrc2[i] &&
rsrc1[i] != "*" &&
rsrc2[i] != "*") {
return false;
}
}
return true;
}
return false;
}
function getResourceWithPolicyRequirements(resource) {
var compProps = resource.properties;
// Loop through the properties for this resource
for (var i = 0; i < compProps.length; i++) {
var propPolicyReqs = new Array();
var reqs;
var prop = compProps[i];
// loop through the policies of each property
for (var j = 0; j < prop.policies.length; j++) {
var policy = getPolicy(prop.policies[j].policyId);
// Check if client validation is enabled, if so add source
if ((policy.clientValidation !== undefined) && policy.clientValidation) {
prop.policies[j].policyFunction = eval(policy.policyExec).toString();
}
prop.policies[j].policyRequirements = policy.policyRequirements;
reqs = policy.policyRequirements;
// loop through the requirements for each policy
for (var x = 0; x < reqs.length; x++) {
}
}
}
// Add the requirements array to the property object
}
// Return all property configs for this resource
return resource;
}
function getAllPolicyRequirements(policies) {
var reqs = [],i;
for (i in policies) {
}
return reqs;
}
var retObj = {},
policyRequirements = new Array(),
if (policy == null) {
}
if (typeof(propValue) == 'undefined') {
continue;
}
}
}
failed = validationFunc.call({ "failedPolicyRequirements": policyRequirements, "allPolicyRequirements": allPolicyRequirements }, fullObject, propValue, params, propName);
}
}
}
}
}
var returnPolicies = new Array();
}
var found = false;
var newPolicy = newPolicies[i];
var policy = returnPolicies[j];
// update old policy with new config
returnPolicies[j] = newPolicy;
found = true;
}
}
if (!found) {
var p = {};
p.params = {};
}
// add new policy
returnPolicies.push(p);
}
found = false;
}
return returnPolicies;
}
var found = false;
found = true;
} else {
}
}
}
if (!found) {
}
found = false;
}
}
function getAdditionalPolicies(id) {
var returnArray = new Array();
var resource;
var object;
if (index != -1) {
} else {
}
if (props != null) {
if (policies != null) {
var property = {};
}
}
}
}
}
}
}
}
return returnArray;
}
function processRequest() {
var resource;
// Get the policy configuration for the specified resource
if (resource == null ) {
resource = {};
resource.properties = new Array();
}
// Update the policy configuration with any resource specific
}
if (method == "read") {
var compArray = new Array();
}
returnObject = {};
} else {
}
} else if (method == "action") {
var failedPolicyRequirements = new Array();
returnObject = {};
throw "No resource specified";
}
if (resource == null) {
// There is no configured policies for this resource (nothing to verify)
returnObject.result = true;
} else {
if (fullObject === undefined) {
}
// Perform the validation
if (action == "validateObject") {
// Validate
}
} else if (action == "validateProperty") {
// Validate
}
} else {
throw "Unsupported action: " + action;
}
// Set the result to true if no failedPolicyRequirements (failures), false otherwise
// Set the return failedPolicyRequirements
}
} else {
throw "Unsupported method: " + method;
}
}
//Load additional policy scripts if configured
if (typeof additionalPolicies != 'undefined') {
try {
eval(additionalPolicies[i]);
} catch (error) {
}
}
}