feat: List local and imported variables in the policy with InspectPolicies

[oguzhand95]

InspectPolicies on disk store

{
    "results": {
        "derived_roles.common_roles": {
            "variables": [
                {
                    "name": "derivedRoleVariable",
                    "value": "request.resource.attr.isDerivedRoleVar",
                    "kind": "KIND_LOCAL",
                    "source": "derived_roles.common_roles"
                }
            ]
        },
        "export_variables.common_variables": {
            "variables": [
                {
                    "name": "commonMarkedResource",
                    "value": "request.resource.attr.markedResource",
                    "kind": "KIND_EXPORTED",
                    "source": "export_variables.common_variables"
                }
            ]
        },
        "principal.john.vdefault": {
            "actions": [
                "*"
            ],
            "variables": [
                {
                    "name": "commonMarkedResource",
                    "value": "request.resource.attr.markedResource",
                    "kind": "KIND_IMPORTED",
                    "source": "export_variables.common_variables"
                },
                {
                    "name": "markedResource",
                    "value": "request.resource.attr.markedResource",
                    "kind": "KIND_LOCAL",
                    "source": "principal.john.vdefault"
                }
            ]
        },
        "resource.leave_request.vdefault": {
            "actions": [
                "*",
                "create",
                "duplicate",
                "view"
            ],
            "variables": [
                {
                    "name": "commonMarkedResource",
                    "value": "request.resource.attr.markedResource",
                    "kind": "KIND_IMPORTED",
                    "source": "export_variables.common_variables"
                },
                {
                    "name": "markedResource",
                    "value": "request.resource.attr.markedResource",
                    "kind": "KIND_LOCAL",
                    "source": "resource.leave_request.vdefault"
                }
            ]
        }
    }
}

cerbosctl inspect policies on disk store

POLICY ID                               ACTIONS                 VARIABLES                           
derived_roles.common_roles                                      derivedRoleVariable                     
export_variables.common_variables                               commonMarkedResource                    
principal.john.vdefault                 *                       commonMarkedResource,markedResource     
resource.leave_request.vdefault         *,create,duplicate,view commonMarkedResource,markedResource 

InspectPolicies on hub store

{
    "results": {
        "principal.john.vdefault": {
            "actions": [
                "*"
            ],
            "variables": [
                {
                    "name": "commonMarkedResource",
                    "value": "request.resource.attr.markedResource",
                    "kind": "KIND_UNKNOWN"
                },
                {
                    "name": "markedResource",
                    "value": "request.resource.attr.markedResource",
                    "kind": "KIND_UNKNOWN"
                }
            ]
        },
        "resource.leave_request.vdefault": {
            "actions": [
                "*",
                "create",
                "duplicate",
                "view"
            ],
            "variables": [
                {
                    "name": "commonMarkedResource",
                    "value": "request.resource.attr.markedResource",
                    "kind": "KIND_UNKNOWN"
                },
                {
                    "name": "markedResource",
                    "value": "request.resource.attr.markedResource",
                    "kind": "KIND_UNKNOWN"
                }
            ]
        }
    }
}

cerbosctl inspect policies on hub store

POLICY ID                       ACTIONS                 VARIABLES                           
principal.john.vdefault         *                       commonMarkedResource,markedResource     
resource.leave_request.vdefault *,create,duplicate,view commonMarkedResource,markedResource

[oguzhand95]

• Refactored the code following your steps and it is simpler now.
• Added used field to denote if a variable is used from a condition. However, the variables defined in the ExportVariables will not show up as used as you've stated. In the policy where they are used, they appear as imported and used.
• If a variable is referenced from a condition, and the variable is nowhere to be found it is now marked as UNDEFINED.

I was querying the unfiltered and filtered policies from the database and still do. I use the unfiltered one to resolve the state of each variable so that we do not report any undefined variables in the inspection. If we only check the filtered policies while inspecting, then some variables may appear as undefined even if they are actually defined in the policies left out. I am not sure if this is the expected resolution though, let me know if this is not what you had in mind.

[charithe]

I was querying the unfiltered and filtered policies from the database and still do. I use the unfiltered one to resolve the state of each variable

If there are a lot of policies, this would be quite inefficient. The list of filtered policies might not even be importing any variables -- in which case we would have done a lot of work for nothing.

Get the list of policies the user is interested in inspecting. While going through that list one by one, load and cache any imported variables as necessary. Or, do one pass, collect the set of imported policies that are referenced but not loaded initially, load all of them as a batch, and do a second pass to handle the unresolved variables.