Refactor policies document

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/iam/policy/policy.go

@@ -131,4 +131,3 @@ func ForEntityType(entityType uint16) ResourcePattern {
 		EntityType: &entityType,
 	}
 }
-

pkg/iam/policy/statement.go

@@ -15,6 +15,8 @@
 package policy
 
 import (
+	"strings"
+
 	"go.probo.inc/probo/pkg/gid"
 )
 
@@ -139,7 +141,22 @@ func (c Condition) Evaluate(ctx ConditionContext) bool {
 	case ConditionIn:
 		for _, v := range c.Values {
 			resolved, ok := resolveValue(v, ctx)
-			if ok && value == resolved {
+			if !ok {
+				continue
+			}
+
+			// Support a comma-separated "set" value, e.g.
+			// principal.organization_ids = "org_1,org_2"
+			if strings.Contains(resolved, ",") {
+				for _, item := range strings.Split(resolved, ",") {
+					if value == strings.TrimSpace(item) {
+						return true
+					}
+				}
+				continue
+			}
+
+			if value == resolved {
 				return true
 			}
 		}
@@ -148,7 +165,20 @@ func (c Condition) Evaluate(ctx ConditionContext) bool {
 	case ConditionNotIn:
 		for _, v := range c.Values {
 			resolved, ok := resolveValue(v, ctx)
-			if ok && value == resolved {
+			if !ok {
+				continue
+			}
+
+			if strings.Contains(resolved, ",") {
+				for _, item := range strings.Split(resolved, ",") {
+					if value == strings.TrimSpace(item) {
+						return false
+					}
+				}
+				continue
+			}
+
+			if value == resolved {
 				return false
 			}
 		}

pkg/iam/policy/statement_test.go

@@ -88,15 +88,28 @@ func TestCondition_Evaluate_Equals(t *testing.T) {
 			want: false,
 		},
 		{
-			name: "equals - match resource.user_id reference",
+			name: "equals - match resource.identity_id reference",
 			condition: Condition{
 				Operator: ConditionEquals,
 				Key:      "principal.id",
-				Values:   []string{"resource.user_id"},
+				Values:   []string{"resource.identity_id"},
 			},
 			ctx: ConditionContext{
 				Principal: map[string]string{"id": "user_123"},
-				Resource:  map[string]string{"user_id": "user_123"},
+				Resource:  map[string]string{"identity_id": "user_123"},
+			},
+			want: true,
+		},
+		{
+			name: "equals - match principal.email to resource.email reference",
+			condition: Condition{
+				Operator: ConditionEquals,
+				Key:      "principal.email",
+				Values:   []string{"resource.email"},
+			},
+			ctx: ConditionContext{
+				Principal: map[string]string{"email": "user@example.com"},
+				Resource:  map[string]string{"email": "user@example.com"},
 			},
 			want: true,
 		},