refactor(jans-cedarling): make all tokens optional when calling Cedarling::authorize

[rmarinn]

Prepare

• Read PR guidelines
• Read license information

---

Description

This PR implements making tokens optional, making it more flexible for users who doesn't have all the tokens.

Target issue

target issue: #10408

closes #10408

Implementation Details

• Implement making tokens optional. Cedarling should create the entities to the best of its ability based on the token(s) it has.
• implement check if if CEDARLING_USER_AUTHZ is enabled; if it is, then the user entity is required
• implement check if CEDARLING_WORKLOAD_AUTHZ enabled; if it is, then the workload entity is required
• if both CEDARLING_USER_AUTHZ and CEDARLING_WORKLOAD_AUTHZ is disabled, error on startup
• renamed some structs and errors that doesn't align with their implementations

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on enhancing the security and robustness of the Cedarling application by improving JWT validation, error handling, entity creation, policy schema parsing, and documentation across multiple modules and files.

Expand for full summary

Summary:

The code changes in this pull request cover a wide range of updates and improvements to the Cedarling application, with a strong emphasis on application security. The changes span multiple modules and files, addressing various aspects of the authorization and policy enforcement mechanisms, token validation, error handling, and documentation.

Some of the key security-focused changes include:

1. Improvements to JWT validation, including the ability to enable/disable signature and status validation, as well as configurable trust modes for ID tokens.
2. Enhancements to error handling and custom error types to provide more detailed information about issues that may arise during the authorization process.
3. Refinements to the entity creation and validation logic, ensuring that user input is properly sanitized and that the application can handle various types of errors and unexpected data.
4. Additions to the Cedar Policy schema parsing and representation, with a focus on robust deserialization and type validation to prevent potential security vulnerabilities.
5. Updates to the documentation, including clarifications and improvements to the token metadata schema and the Cedarling Python bindings.

Overall, the changes in this pull request demonstrate a strong commitment to maintaining the security and integrity of the Cedarling application. The attention to detail in the error handling, input validation, and token management mechanisms is particularly noteworthy and should help to mitigate potential security risks.

Files Changed:

1. jans-cedarling/bindings/cedarling_python/PYTHON_TYPES.md: Updates to the documentation for the Cedarling Python bindings, including changes to the Request class and the addition of new error types.
2. jans-cedarling/bindings/cedarling_python/cedarling_python.pyi: Changes to the Python type hint (stub) file, including making the token attributes of the Request class optional.
3. jans-cedarling/bindings/cedarling_python/src/authorize/errors.rs: Improvements to error handling and exception management in the authorize module, including the definition of custom exception types.
4. docs/cedarling/cedarling-policy-store.md: Updates to the documentation for the Cedarling Policy Store, with a focus on the token metadata schema and trusted issuers.
5. jans-cedarling/bindings/cedarling_python/src/authorize/request.rs: Refactoring of the Request struct to make the token fields optional.
6. jans-cedarling/cedarling/examples/authorize_without_jwt_validation.rs: An example of authorizing a request without JWT validation, which raises security concerns.
7. jans-cedarling/cedarling/examples/authorize_with_jwt_validation.rs: An example of authorizing a request with JWT validation, demonstrating the importance of proper token handling.
8. jans-cedarling/cedarling/src/authz/entities/create.rs: Implementation of entity creation, with a focus on input validation and error handling.
9. jans-cedarling/cedarling/src/authz/entities/mod.rs: Improvements to the creation of various entities, including tokens, resources, and roles.
10. jans-cedarling/cedarling/src/authz/authorize_result.rs: Refactoring of the AuthorizeResult struct and associated functions.
11. jans-cedarling/cedarling/src/authz/entities/test_create.rs: Test cases covering the creation of entities, including error handling.
12. jans-cedarling/cedarling/src/authz/entities/trait_as_expression.rs: Refactoring and cleanup of the AsExpression trait.
13. jans-cedarling/cedarling/src/authz/entities/user.rs: Implementation of the create_user_entity function, with a focus on token validation and error handling.
14. jans-cedarling/cedarling/src/authz/merge_json.rs: Implementation of a function to merge JSON values, with conflict handling.
15. jans-cedarling/cedarling/src/authz/entities/workload.rs: Implementation of the create_workload_entity function, with token validation and error handling.
16. jans-cedarling/cedarling/src/authz/request.rs: Changes to the Request struct, making the token fields optional.

Code Analysis

We ran 9 analyzers against 30 files and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[olehbozhok]

how about diagnostics ?

[olehbozhok]

Why we need this?

[rmarinn]

we have a TokenKind::Transaction so i added it for completeness' sake.

[rmarinn]

i just removed it here since it seems easy enough to add back later: 87b399f.

[olehbozhok]

adding 2 lines we can avoid clone whole structure of entities_data

Suggested change

	// Convert [`AuthorizeEntitiesData`] to [`cedar_policy::Entities`] structure,
	// hold all entities that will be used on authorize check.
	let entities = entities_data.entities(Some(&schema.schema))?;
	// Check authorize where principal is `"Jans::Workload"` from cedar-policy schema.
	let workload_result: Option<Response> = if self.config.authorization.use_workload_principal
	{
	match self.execute_authorize(ExecuteAuthorizeParameters {
	entities: &entities,
	principal: principal_workload_uid.clone(),
	action: action.clone(),
	resource: resource_uid.clone(),
	context: context.clone(),
	}) {
	Ok(resp) => Some(resp),
	Err(err) => return Err(AuthorizeError::CreateRequestWorkloadEntity(err)),
	}
	} else {
	None
	};
	let entities = entities_data.clone().entities(Some(&schema.schema))?;
	let (workload_authz_result, workload_authz_info, workload_entity_claims) =
	if let Some(workload) = entities_data.workload {
	let principal = workload.uid();
	let workload_principal = entities_data.workload.as_ref().map(|e| e.uid()).to_owned();
	let user_principal = entities_data.user.as_ref().map(|e| e.uid()).to_owned();
	// Convert [`AuthorizeEntitiesData`] to [`cedar_policy::Entities`] structure,
	// hold all entities that will be used on authorize check.
	let entities = entities_data.entities(Some(&schema.schema))?;
	let (workload_authz_result, workload_authz_info, workload_entity_claims) =
	if let Some(workload) = workload_principal {
	let principal = workload;

[olehbozhok]

resolved in a4cbbda

[olehbozhok]

added comment
#10436 (comment)

[olehbozhok]

Looks OK to me, but need to notice about #10436 (comment)