webhookey/src/filters.rs

use crate::WebhookeyError;
use anyhow::Result;
use ipnet::IpNet;
use log::{debug, error, trace};
use regex::Regex;
use rocket::{http::HeaderMap, Request};
use serde::{Deserialize, Serialize};
use std::net::IpAddr;

#[derive(Debug, Deserialize, Serialize)]
#[serde(deny_unknown_fields, untagged)]
pub enum AddrType {
    IpAddr(IpAddr),
    IpNet(IpNet),
}

impl AddrType {
    pub fn matches(&self, client_ip: &IpAddr) -> bool {
        match self {
            AddrType::IpAddr(addr) => addr == client_ip,
            AddrType::IpNet(net) => net.contains(client_ip),
        }
    }
}

#[derive(Debug, Deserialize, Serialize)]
#[serde(deny_unknown_fields, rename_all = "lowercase")]
pub enum IpFilter {
    Allow(Vec<AddrType>),
    Deny(Vec<AddrType>),
}

impl IpFilter {
    pub fn validate(&self, client_ip: &IpAddr) -> bool {
        match self {
            IpFilter::Allow(list) => list.iter().any(|i| i.matches(client_ip)),
            IpFilter::Deny(list) => !list.iter().any(|i| i.matches(client_ip)),
        }
    }
}

#[derive(Debug, Deserialize, Serialize)]
pub struct HeaderFilter {
    pub field: String,
    #[serde(with = "serde_regex")]
    pub regex: Regex,
}

impl HeaderFilter {
    pub fn evaluate(&self, headers: &HeaderMap) -> Result<bool, WebhookeyError> {
        trace!(
            "Matching `{}` on `{}` from received header",
            &self.regex,
            &self.field,
        );

        if let Some(value) = headers.get_one(&self.field) {
            if self.regex.is_match(value) {
                debug!("Regex `{}` for `{}` matches", &self.regex, &self.field);

                return Ok(true);
            }
        }

        debug!(
            "Regex `{}` for header field `{}` does not match",
            &self.regex, &self.field
        );

        Ok(false)
    }
}

#[derive(Debug, Deserialize, Serialize)]
#[serde(deny_unknown_fields)]
pub struct JsonFilter {
    pub pointer: String,
    #[serde(with = "serde_regex")]
    pub regex: Regex,
}

impl JsonFilter {
    pub fn evaluate(&self, data: &serde_json::Value) -> Result<bool, WebhookeyError> {
        trace!(
            "Matching `{}` on `{}` from received json",
            &self.regex,
            &self.pointer,
        );

        if let Some(value) = data.pointer(&self.pointer) {
            if self.regex.is_match(&crate::get_string(value)?) {
                debug!("Regex `{}` for `{}` matches", &self.regex, &self.pointer);

                return Ok(true);
            }
        }

        debug!(
            "Regex `{}` for json field `{}` does not match",
            &self.regex, &self.pointer
        );

        Ok(false)
    }
}

macro_rules! interrelate {
    ($request:expr, $data:expr, $filters:expr, $relation:ident) => {{
        let (mut results, mut errors) = (Vec::new(), Vec::new());

        $filters
            .iter()
            .map(|filter| filter.evaluate($request, $data))
            .for_each(|item| match item {
                Ok(o) => results.push(o),
                Err(e) => errors.push(e),
            });

        if errors.is_empty() {
            Ok(results.iter().$relation(|r| *r))
        } else {
            errors
                .iter()
                .for_each(|e| error!("Could not evaluate Filter: {}", e));

            Err(WebhookeyError::InvalidFilter)
        }
    }};
}

#[derive(Debug, Deserialize, Serialize)]
#[serde(deny_unknown_fields, rename_all = "lowercase")]
pub enum FilterType {
    Not(Box<FilterType>),
    And(Vec<FilterType>),
    Or(Vec<FilterType>),
    #[serde(rename = "header")]
    HeaderFilter(HeaderFilter),
    #[serde(rename = "json")]
    JsonFilter(JsonFilter),
}

impl FilterType {
    pub fn evaluate(
        &self,
        request: &Request,
        data: &serde_json::Value,
    ) -> Result<bool, WebhookeyError> {
        match self {
            FilterType::Not(filter) => Ok(!filter.evaluate(request, data)?),
            FilterType::And(filters) => interrelate!(request, data, filters, all),
            FilterType::Or(filters) => interrelate!(request, data, filters, any),
            FilterType::HeaderFilter(filter) => filter.evaluate(request.headers()),
            FilterType::JsonFilter(filter) => filter.evaluate(data),
        }
    }
}