PDP (Policy Decision Point)

// Policy Decision Point implementation
class PolicyDecisionPoint {
  constructor(policyStore) {
    this.policyStore = policyStore
    this.cache = new Map()
  }

  // Main authorization decision method
  async authorize(request) {
    const { subject, resource, action, environment } = request

    // Check cache first (with TTL)
    const cacheKey = this.getCacheKey(request)
    const cached = this.cache.get(cacheKey)
    if (cached && cached.expiry > Date.now()) {
      return cached.decision
    }

    try {
      // Retrieve applicable policies
      const policies = await this.policyStore.getPolicies({
        resourceType: resource.type,
        action: action
      })

      // Evaluate policies in order of priority
      const decision = this.evaluatePolicies(
        policies,
        subject,
        resource,
        action,
        environment
      )

      // Cache decision (short TTL for security)
      this.cache.set(cacheKey, {
        decision,
        expiry: Date.now() + 60000 // 1 minute
      })

      // Audit the decision
      await this.auditDecision(request, decision)

      return decision
    } catch (error) {
      // Fail closed - deny on error
      return {
        decision: 'DENY',
        reason: 'Policy evaluation error',
        error: error.message
      }
    }
  }

  evaluatePolicies(policies, subject, resource, action, environment) {
    let finalDecision = 'DENY' // Default deny
    let obligations = []
    let advice = []

    for (const policy of policies) {
      const result = this.evaluatePolicy(
        policy,
        subject,
        resource,
        action,
        environment
      )

      if (result.effect === 'DENY') {
        // Any deny = final deny (deny overrides)
        return {
          decision: 'DENY',
          reason: result.reason,
          matchedPolicy: policy.id
        }
      }

      if (result.effect === 'PERMIT') {
        finalDecision = 'PERMIT'
        obligations = obligations.concat(result.obligations || [])
        advice = advice.concat(result.advice || [])
      }
    }

    return {
      decision: finalDecision,
      obligations, // Must be enforced (e.g., log access)
      advice,      // Should be enforced (e.g., notify owner)
      evaluatedPolicies: policies.map(p => p.id)
    }
  }

  evaluatePolicy(policy, subject, resource, action, environment) {
    // Check if policy target matches
    if (!this.matchesTarget(policy.target, subject, resource, action)) {
      return { effect: 'NOT_APPLICABLE' }
    }

    // Evaluate condition
    const conditionMet = this.evaluateCondition(
      policy.condition,
      subject,
      resource,
      action,
      environment
    )

    if (!conditionMet) {
      return { effect: 'NOT_APPLICABLE' }
    }

    return {
      effect: policy.effect, // PERMIT or DENY
      reason: policy.description,
      obligations: policy.obligations,
      advice: policy.advice
    }
  }

  evaluateCondition(condition, subject, resource, action, environment) {
    // Example: evaluate complex condition expression
    // "subject.department === resource.department AND environment.time.hour < 17"

    try {
      // Use safe expression evaluator (NOT eval()!)
      const context = {
        subject: subject.attributes,
        resource: resource.attributes,
        action: action,
        environment: environment
      }

      return this.safeEvaluate(condition, context)
    } catch (error) {
      // Fail closed on evaluation error
      return false
    }
  }

  getCacheKey(request) {
    return JSON.stringify({
      subject: request.subject.id,
      resource: request.resource.id,
      action: request.action
    })
  }

  async auditDecision(request, decision) {
    await auditLog.log({
      timestamp: new Date().toISOString(),
      type: 'authorization_decision',
      subject: request.subject.id,
      resource: request.resource.id,
      action: request.action,
      decision: decision.decision,
      reason: decision.reason,
      policies: decision.evaluatedPolicies
    })
  }
}

// Using PDP in API
const pdp = new PolicyDecisionPoint(policyStore)

app.delete('/api/documents/:id', async (req, res) => {
  const decision = await pdp.authorize({
    subject: {
      id: req.user.id,
      attributes: req.user
    },
    resource: {
      id: req.params.id,
      type: 'document',
      attributes: await getDocumentAttributes(req.params.id)
    },
    action: 'DELETE',
    environment: {
      time: new Date(),
      ipAddress: req.ip,
      userAgent: req.headers['user-agent']
    }
  })

  if (decision.decision === 'DENY') {
    return res.status(403).json({
      error: 'Forbidden',
      reason: decision.reason
    })
  }

  // Enforce obligations
  for (const obligation of decision.obligations || []) {
    await enforceObligation(obligation)
  }

  // Proceed with delete
  await deleteDocument(req.params.id)
  res.status(204).send()
})