Skip to content

Commit

Permalink
Update expression profiles coverage
Browse files Browse the repository at this point in the history
  • Loading branch information
@mederly
mederly committed Aug 25, 2023
1 parent 387978c commit 8222532
Showing 1 changed file with 115 additions and 119 deletions.
234 changes: 115 additions & 119 deletions docs/expressions/expressions/profiles/coverage.adoc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -50,80 +50,82 @@ It is obviously not a proof of correctness and/or completeness of the implementa

As an *experimental feature*, expressions profiles (EPs for short) are supported also at the following places:

.Support for expression profiles for expressions
[%autowidth]
|===
| Description | Covered path | Description | Reference

| EP applied to role auto-assignment mapping
| `autoassign/focus/mapping`
| #TODO#
This row just states that that profile is correctly set up for role auto-assignment mappings.
| `test120RestrictedRoleAutoBadMappingExpression`,
`test130RestrictedRoleAutoBadMappingCondition`



| Role auto-assignment mapping expression
| `autoassign/focus/mapping/expression`
|

| Role auto-assignment mapping condition
| `autoassign/focus/mapping/condition`
| `test130RestrictedRoleAutoBadMappingCondition`

| Induced focus mapping expression
| `inducement/focusMappings/mapping/expression`
| `test210RestrictedRoleBadFocusMapping`

| Induced construction mapping expression
| `inducement/construction/attribute/outbound/expression`
| `test220RestrictedRoleBadConstructionMapping`

| Assignment condition expression
| `assignment/condition/expression`
| `test230RestrictedRoleBadAssignmentCondition`

| Inducement condition expression
| `inducement/condition/expression`
| `test240RestrictedRoleBadInducementCondition`

| Role condition expression
| `condition/expression` (in role)
| `test245RestrictedRoleBadRoleCondition`

| Filter in assignment target reference
| `assignment/targetRef/filter/.../expression`
| `test250RestrictedRoleBadAssignmentTargetFilter`

| Filter in inducement target reference
| `inducement/targetRef/filter/.../expression`
| `test260RestrictedRoleBadInducementTargetFilter`

| Explicit script in bulk action
| `executeScript/.../execute`
| `test310UntrustedBulkExecutingScriptDirectly`

| Explicit expression in bulk action
| `executeScript/.../evaluateExpression`
| `test315UntrustedBulkExecutingScriptViaExpression`

| Script embedded in a custom notification in bulk action
| `executeScript/.../notify/handler/expressionFilter`
| `test320UntrustedBulkExecutingScriptViaNotification`

| Script in object query in `search` bulk action
| `executeScript/.../search/query/filter/.../expression`
| `test325UntrustedBulkExecutingScriptViaSearchFilter`

| Script in filter in `unassign` bulk action
| `executeScript/.../unassign/filter/.../expression`
| `test330UntrustedBulkExecutingScriptViaUnassignFilter`

|===

NOTE: The `autoassign/focus/selector/filter` does not need expression profiles, because expressions are not supported at that place.
See `test110RestrictedRoleAutoFilterExpression`.
#TODO#

// .Support for expression profiles for expressions
// [%autowidth]
// |===
// | Description | Covered path | Description | Reference
//
// | EP applied to role auto-assignment mapping
// | `autoassign/focus/mapping`
// | #TODO#
// This row just states that that profile is correctly set up for role auto-assignment mappings.
// | `test120RestrictedRoleAutoBadMappingExpression`,
// `test130RestrictedRoleAutoBadMappingCondition`
//
//
//
// | Role auto-assignment mapping expression
// | `autoassign/focus/mapping/expression`
// |
//
// | Role auto-assignment mapping condition
// | `autoassign/focus/mapping/condition`
// | `test130RestrictedRoleAutoBadMappingCondition`
//
// | Induced focus mapping expression
// | `inducement/focusMappings/mapping/expression`
// | `test210RestrictedRoleBadFocusMapping`
//
// | Induced construction mapping expression
// | `inducement/construction/attribute/outbound/expression`
// | `test220RestrictedRoleBadConstructionMapping`
//
// | Assignment condition expression
// | `assignment/condition/expression`
// | `test230RestrictedRoleBadAssignmentCondition`
//
// | Inducement condition expression
// | `inducement/condition/expression`
// | `test240RestrictedRoleBadInducementCondition`
//
// | Role condition expression
// | `condition/expression` (in role)
// | `test245RestrictedRoleBadRoleCondition`
//
// | Filter in assignment target reference
// | `assignment/targetRef/filter/.../expression`
// | `test250RestrictedRoleBadAssignmentTargetFilter`
//
// | Filter in inducement target reference
// | `inducement/targetRef/filter/.../expression`
// | `test260RestrictedRoleBadInducementTargetFilter`
//
// | Explicit script in bulk action
// | `executeScript/.../execute`
// | `test310UntrustedBulkExecutingScriptDirectly`
//
// | Explicit expression in bulk action
// | `executeScript/.../evaluateExpression`
// | `test315UntrustedBulkExecutingScriptViaExpression`
//
// | Script embedded in a custom notification in bulk action
// | `executeScript/.../notify/handler/expressionFilter`
// | `test320UntrustedBulkExecutingScriptViaNotification`
//
// | Script in object query in `search` bulk action
// | `executeScript/.../search/query/filter/.../expression`
// | `test325UntrustedBulkExecutingScriptViaSearchFilter`
//
// | Script in filter in `unassign` bulk action
// | `executeScript/.../unassign/filter/.../expression`
// | `test330UntrustedBulkExecutingScriptViaUnassignFilter`
//
// |===
//
// NOTE: The `autoassign/focus/selector/filter` does not need expression profiles, because expressions are not supported at that place.
// See `test110RestrictedRoleAutoFilterExpression`.

=== Mappings

Expand All @@ -140,24 +142,41 @@ Currently, the mappings can be used in the following places #TODO fill the table
|===
| Ident | Place | Description | Status | Path | Reference

.2+| `[EP:M:PRC]`
.2+| policy rule condition
.2+| The policy rule conditions are evaluated as mappings.
.2+| OK

| `systemConfiguration:globalPolicyRule/condition`
| not needed

| `mark:policyRule/condition`
| #TODO#

| `[EP:M:IM]`
| inbound mappings
| Inbound mappings come from the particular resource.
| OK (Except for resource inheritance.)
| attribute, association, and auxiliary object class definitions
|

| `[EP:M:OM]`
| outbound mappings
|
| OK (Except for resource inheritance.)
|
|

| `[EP:M:AFM]`
| assigned focus mappings
|
| OK
|
|

| `[EP:M:AAFM]`
| auto-assignment focus mappings
|
| OK
|
|

| `[EP:M:TFM]`
| template focus mappings
|
| OK
|
|

.2+| `[EP:M:ARC]`
.2+| assignment or role condition
.2+| The assignment and role conditions are evaluated as mappings.
Expand All @@ -176,6 +195,17 @@ Currently, the mappings can be used in the following places #TODO fill the table
|
|

.2+| `[EP:M:PRC]`
.2+| policy rule condition
.2+| The policy rule conditions are evaluated as mappings.
.2+| OK

| `systemConfiguration:globalPolicyRule/condition`
| not needed

| `mark:policyRule/condition`
| #TODO#

| `[EP:M:MM]`
| metadata mapping
| This is experimental functionality, anyway.
Expand All @@ -190,40 +220,6 @@ Currently, the mappings can be used in the following places #TODO fill the table
|
|

| `[EP:M:FM]`
| focus mappings
|
| OK
|
|

| `[EP:M:AFM]`
| assigned focus mappings
|
| OK
|
|

| `[EP:M:AAFM]`
| auto-assignment focus mappings
|
| OK
|
|

| `[EP:M:TFM]`
| template focus mappings
|
| OK
|
|

| `[EP:M:OM]`
| outbound mappings
|
| OK
|
|
|===

The status of `OK` means that the code was checked for compliance.
Expand Down

0 comments on commit 8222532

Please sign in to comment.