Module membership_conditions 

Need-to-know project groups, step 2 (issue #151): conditions on membership. A restricted group with a need-to-know policy can require, on top of membership,

• claims of the identity provider – site = main-office, partner-workshop, nda = true – taken from the user’s last single sign-on (a change at the identity provider applies at the next sign-in; local accounts have no claims and never meet such a condition);
• networks – the client address must be in one of the ranges (the same client address as the sign-in throttle: the peer, or the entry the reverse proxy added to X-Forwarded-For);
• a maximum sign-in age – the group is visible only for so many hours after signing in (the web session’s start; for tokens and notifications the user’s last sign-in), so a person removed at the identity provider loses it at the latest then.

A reader who does not meet the conditions is treated as a non-member: the group is hidden (“not found”), administrators included. Claims and the sign-in age are part of the SQL that builds the hidden groups (unmet_sql in services::access::hidden_of_user), so they also hold for tokens, the assistant and notification recipients; networks and the session’s age depend on the request and are applied by the extractors (apply). A member refused by a condition is recorded once per session (project.access_refused).

Structs

ClaimCondition

One claim condition: the claim must hold one of the values (compared without case; a list claim such as groups needs one of its entries).

Conditions

The conditions of a group (none = membership alone, as before).

ConditionsUpdate

A change of the conditions; None leaves a part as it is.

Network

An address range (10.0.0.0/8, 2001:db8::/32; a bare address is one host).

Origin

Where a request comes from, for the conditions that depend on it.

Constants

MAX_CLAIMS

Most claim conditions of a group.

MAX_NETWORKS

Most network ranges of a group.

MAX_SIGNIN_AGE_HOURS

Longest maximum sign-in age (a year).

MAX_VALUES

Most accepted values of one claim condition.

Functions

apply

The actor as the request may see it: groups whose network or session-age condition the request does not meet are hidden (claims and the last sign-in are already part of the actor’s hidden groups). One query; without conditioned groups nothing changes. A member refused by any condition is recorded once per origin.key.

at_least_as_strict

Whether new asks at least as much as old (every old claim condition kept with no new accepted value, every new range inside an old one, a sign-in age no longer than before). Anything else loosens the group.

claim_lines

Claim conditions as text lines (the form field).

claim_values

The claims of an ID token (and userinfo) as name → values.

claims_to_store

The claims of a sign-in as they are stored: names to lower-case values (a string, a number, a boolean or a list of them; other shapes are left out), only for the claims in wanted.

network_allows

Whether the client is in one of the ranges; an unknown client is not.

of

The conditions of a group (empty without a policy row).

parse_claim_lines

Claim conditions from text, one per line: claim = value, value.

set

Sets the conditions on membership of a restricted group (managers and administrators).

unmet_sql

SQL: the conditions of the policy row pp that the user aliased u does not meet with their stored claims and last sign-in (TRUE = not met). Without conditions (or without a policy row) it is FALSE.

validate

Checks and normalises conditions: claim names are identifiers, values are lower case, networks are canonical ranges, the sign-in age is 1 to MAX_SIGNIN_AGE_HOURS hours.

wanted_claims

The claim names any group’s conditions name: the claims kept from a sign-in.