[RORDEV-1562] Separate ROR KBN authentication and authorization rules #1163

mgoworko · 2025-09-20T11:40:24Z

🚀Added separate ROR KBN authentication and authorization rules

Summary by CodeRabbit

New Features
- Split combined KBN rule into separate authentication and authorization rules that compose; JWT handling centralized for KBN flows.
Refactor
- Rule ordering, decoder selection, variable usage and local-user resolution updated to recognize the new rule types; group-matching logic unified and improved; impersonation-warning handling expanded.
Tests
- Added extensive unit and integration tests covering decoding, YAML configs, JWT signatures, authn/authz flows and groups logic.

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/base/RorKbnRuleHelper.scala

...src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/RorKbnAuthenticationRule.scala

.../src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/RorKbnAuthorizationRule.scala

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/RorKbnAuthRule.scala

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/users/LocalUsersContext.scala

...ain/scala/tech/beshu/ror/accesscontrol/factory/decoders/rules/auth/RorKbnRulesDecoders.scala

...test/scala/tech/beshu/ror/integration/RorKbnAuthenticationYamlLoadedAccessControlTests.scala

.../test/scala/tech/beshu/ror/integration/RorKbnAuthnAndAuthzYamlLoadedAccessControlTests.scala

core/src/test/scala/tech/beshu/ror/unit/acl/blocks/rules/auth/RorKbnAuthRuleTests.scala

...ain/scala/tech/beshu/ror/accesscontrol/factory/decoders/rules/auth/RorKbnRulesDecoders.scala

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/base/BaseRorKbnRule.scala

coutoPL

LGTM

mgoworko

Description of the changes after e2e tests:

...src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/RorKbnAuthenticationRule.scala

.../src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/RorKbnAuthorizationRule.scala

...ain/scala/tech/beshu/ror/accesscontrol/factory/decoders/rules/auth/RorKbnRulesDecoders.scala

...test/scala/tech/beshu/ror/integration/RorKbnAuthenticationYamlLoadedAccessControlTests.scala

.../src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/RorKbnAuthorizationRule.scala

...ain/scala/tech/beshu/ror/accesscontrol/factory/decoders/rules/auth/RorKbnRulesDecoders.scala

coutoPL · 2025-10-09T16:27:41Z

...ain/scala/tech/beshu/ror/accesscontrol/factory/decoders/rules/auth/RorKbnRulesDecoders.scala

+            val rule = new RorKbnAuthorizationRule(settings)
+            Right(RuleDefinition.create[RorKbnAuthorizationRule](rule))
+          case (Some(_), None) =>
+            Left(RulesLevelCreationError(Message(s"Cannot create ${RorKbnAuthorizationRule.Name.name.show} - missing groups settings")))


Maybe "missing groups logic"? And maybe it'd be good to add this link to the doc too?

https://github.com/beshu-tech/readonlyrest-docs/blob/master/details/authorization-rules-details.md#checking-groups-logic

Added this link in both places. Is it correct, that this section is not published on docs.readonlyrest.com ? (At least I couldn't find it)

Probably not. During adding the new rules descriptions, could you please check why?

On docs.readonlyrest.com the authorization-rules-details.md document is linked as redirection to Github repo blob, not a document exposed on the website. I'm not sure if it is correct, but the links are in this PR are done the same way, so it is consistent.

...ain/scala/tech/beshu/ror/accesscontrol/factory/decoders/rules/auth/RorKbnRulesDecoders.scala

coutoPL

LGTM

mgoworko added 5 commits September 20, 2025 13:35

qs

77784ea

qs

b5bdb15

qs

05cbfa7

qs

bddcd35

self review

d8eeccb

mgoworko marked this pull request as ready for review September 21, 2025 13:19

This comment was marked as outdated.

Sign in to view

This comment was marked as resolved.

Sign in to view

mgoworko added 2 commits September 21, 2025 16:08

qs

1813518

qs

b8b9b8a

This comment was marked as resolved.

Sign in to view

mgoworko requested a review from coutoPL September 21, 2025 14:50

coutoPL requested changes Oct 3, 2025

View reviewed changes

mgoworko added 2 commits October 3, 2025 20:14

Merge remote-tracking branch 'origin/develop' into RORDEV-1562

016fce4

review changes

ef222e1

This comment was marked as resolved.

Sign in to view

coutoPL reviewed Oct 4, 2025

View reviewed changes

...ain/scala/tech/beshu/ror/accesscontrol/factory/decoders/rules/auth/RorKbnRulesDecoders.scala Outdated Show resolved Hide resolved

core/src/main/scala/tech/beshu/ror/accesscontrol/blocks/rules/auth/base/BaseRorKbnRule.scala Outdated Show resolved Hide resolved

mgoworko added 3 commits October 4, 2025 23:04

review changes

d8399b1

review changes

2e1dd75

Merge remote-tracking branch 'origin/develop' into RORDEV-1562

3057602

coutoPL approved these changes Oct 5, 2025

View reviewed changes

This comment was marked as outdated.

Sign in to view

fix and tests

5edf9d1

mgoworko force-pushed the RORDEV-1562 branch from ed5a123 to 5edf9d1 Compare October 6, 2025 14:59

This comment was marked as outdated.

Sign in to view

mgoworko commented Oct 6, 2025

View reviewed changes

mgoworko requested a review from coutoPL October 6, 2025 16:24

option 3 with tests

9134116

This comment was marked as resolved.

Sign in to view

coutoPL reviewed Oct 8, 2025

View reviewed changes

mgoworko added 4 commits October 9, 2025 17:22

review changes

23c2020

qs

2d1d80f

qs

753c83e

Merge remote-tracking branch 'origin/develop' into RORDEV-1562

9513df8

This comment was marked as outdated.

Sign in to view

coutoPL requested changes Oct 9, 2025

View reviewed changes

docs links

db3f414

mgoworko requested a review from coutoPL October 10, 2025 18:45

This comment was marked as outdated.

Sign in to view

coutoPL approved these changes Oct 10, 2025

View reviewed changes

mgoworko merged commit 6dbd71d into sscarduzio:develop Oct 11, 2025
22 checks passed

[RORDEV-1562] Separate ROR KBN authentication and authorization rules #1163

[RORDEV-1562] Separate ROR KBN authentication and authorization rules #1163

Uh oh!

Conversation

mgoworko commented Sep 20, 2025 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

This comment was marked as outdated.

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

coutoPL left a comment

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

mgoworko left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

coutoPL Oct 9, 2025

Choose a reason for hiding this comment

Uh oh!

mgoworko Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

coutoPL Oct 10, 2025

Choose a reason for hiding this comment

Uh oh!

mgoworko Oct 11, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

coutoPL left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mgoworko commented Sep 20, 2025 •

edited by coderabbitai bot

Loading