Major Description
We have a need to do set inclusion and intersection checking in policy conditions. Currently, array.includes() and array.intersects() are not supported by the Nashorn engine. We have written javascript "polyfills" that add includes() and intersects() to the array prototype. We want to add them to org.apache.ranger.plugin.util.RangerCommonConstants, so that the constants may be added to SCRIPT_PREEXEC in org.apache.ranger.plugin.policyengine.RangerRequestScriptEvaluator.
Business Use Case: For example, is the business partner named in the table's partner column among those whose data the user has permission to see? Currently in our row filter policy this must be expressed as: $USER.partners.indexOf(partner) > -1. It would be nice to instead write $USER.partners.includes(partner).
More significantly, we need to test for set intersection. For example, our tables are tagged with the partner tag, which has an attribute value that contains an array of partners whose data is included in the table.* If there is no partner in common, ie no intersection, between the partner tag.value array and the USER.partners array, the user should be denied access to the table. Currently in our tag policy this is expressed as:
var result = TAG.value.split(",").filter(function( n ) {
return USER.partners.indexOf( n ) > -1;
}); result.length != 0;
We would much prefer this direct way to express intersection:
TAG.value.split(",").intersects(USER.partners);
--
*Actually, a comma-separated string of partners which we convert to an array using split, since Ranger can't currently handle arrays as tag attributes.