authservice
authservice copied to clipboard
POC: and/or/not semantics in filter chain matcher
This is a necessary feature to realize #172: by introducing the and/or/not semantics into the filter chain match, we can integrate the features that currently realize TriggerRule into Matcher. For example, in the previous implementation, the
- If
/path1
is matched, authentication is performed - If
test.com
is matched, authentication is performed
However, when we integrated TriggerRule and Matcher in #172, we can no longer write rules that require such and semantics. This is why this is necessary.
Authenticate if path matches /path1
and domain matches test.com
.
{
"matches": [{
"and": [
{
default": {
"header": ":path",
"equality": "/path1"
}
},
{
"default": {
"header": ":authority",
"equality": "test.com"
},
}
]
}]
}
If path matches /path2
and domain matches test2.com
, do not authenticate.
{
"matches": [{
"or": [
{
"not": {
"header": ":path",
"equality": "/path1"
},
}
{
"not": {
"header": ":authority",
"equality": "test.com"
},
}
]
}]
}
To achieve this, we need an API like the following
message Default {
Match match = 1;
}
message Not {
Unit unit = 1;
}
message And {
repeatedly Unit unit = 1;
}
message Or {
repeatedly Unit unit = 1;
}
message Unit {
oneof {
Default default = 1;
Not not = 2;
And and = 3;
Or or = 4;
}
}
message Matches {
repeatedly Unit unit = 1;
}