Attribute Based Access Control — Flexible ABAC Implementation

// ABAC policy engine
class ABACEngine {
  constructor() {
    this.policies = [];
  }

  addPolicy(policy) {
    this.policies.push(policy);
  }

  evaluate(request) {
    const matchingPolicies = this.policies.filter(p => this.matchesTarget(p, request));
    if (matchingPolicies.length === 0) return { allowed: false, reason: 'No matching policy' };

    // First matching allow/deny wins
    for (const policy of matchingPolicies) {
      for (const rule of policy.rules) {
        if (this.evaluateCondition(rule.condition, request)) {
          return { allowed: rule.effect === 'Allow', rule: rule.name, policy: policy.name };
        }
      }
    }

    return { allowed: false, reason: 'No rule matched' };
  }

  evaluateCondition(condition, request) {
    if (!condition) return true;

    switch (condition.operator) {
      case 'equals':
        return this.resolveAttribute(condition.attribute, request) === condition.value;

      case 'in':
        return condition.value.includes(this.resolveAttribute(condition.attribute, request));

      case 'greaterThan':
        return this.resolveAttribute(condition.attribute, request) > condition.value;

      case 'and':
        return condition.conditions.every(c => this.evaluateCondition(c, request));

      case 'or':
        return condition.conditions.some(c => this.evaluateCondition(c, request));

      default:
        return false;
    }
  }

  resolveAttribute(attribute, request) {
    if (attribute.startsWith('user.')) return request.user[attribute.slice(5)];
    if (attribute.startsWith('resource.')) return request.resource[attribute.slice(9)];
    if (attribute.startsWith('env.')) return request.environment[attribute.slice(4)];
    return null;
  }
}

// Example policy
const policy = {
  name: 'ScanDeletion',
  target: { resourceType: 'scan' },
  rules: [{
    name: 'OwnerCanDelete',
    effect: 'Allow',
    condition: {
      operator: 'equals',
      attribute: 'user.id',
      value: '${resource.ownerId}'
    }
  }, {
    name: 'AdminCanDelete',
    effect: 'Allow',
    condition: {
      operator: 'and',
      conditions: [
        { operator: 'equals', attribute: 'user.role', value: 'admin' },
        { operator: 'equals', attribute: 'env.timeOfDay', value: 'business_hours' }
      ]
    }
  }]
};