PEP (Policy Enforcement Point)

// Policy Enforcement Point implementation
class PolicyEnforcementPoint {
  constructor(pdp) {
    this.pdp = pdp // Policy Decision Point
    this.obligationHandlers = new Map()
  }

  // Express middleware as PEP
  middleware() {
    return async (req, res, next) => {
      try {
        // Extract authorization context
        const authzRequest = this.buildAuthzRequest(req)

        // Query PDP for decision
        const decision = await this.pdp.authorize(authzRequest)

        if (decision.decision === 'DENY') {
          return res.status(403).json({
            error: 'Forbidden',
            message: decision.reason || 'Access denied'
          })
        }

        if (decision.decision === 'PERMIT') {
          // Enforce obligations before allowing access
          await this.enforceObligations(decision.obligations)

          // Store decision context for downstream handlers
          req.authzContext = {
            decision,
            obligations: decision.obligations,
            advice: decision.advice
          }

          return next()
        }

        // INDETERMINATE or error - fail closed
        return res.status(403).json({
          error: 'Forbidden',
          message: 'Authorization could not be determined'
        })

      } catch (error) {
        // Fail closed on error
        console.error('PEP error:', error)
        return res.status(500).json({
          error: 'Internal Server Error',
          message: 'Authorization check failed'
        })
      }
    }
  }

  buildAuthzRequest(req) {
    return {
      subject: {
        id: req.user?.id,
        attributes: {
          roles: req.user?.roles || [],
          department: req.user?.department,
          ...req.user
        }
      },
      resource: {
        id: req.params.id || req.path,
        type: this.getResourceType(req.path),
        attributes: {
          path: req.path,
          method: req.method
        }
      },
      action: this.getAction(req.method),
      environment: {
        time: new Date(),
        ipAddress: req.ip,
        userAgent: req.headers['user-agent'],
        protocol: req.protocol,
        sourceNetwork: this.getNetworkZone(req.ip)
      }
    }
  }

  getAction(method) {
    const actionMap = {
      'GET': 'READ',
      'POST': 'CREATE',
      'PUT': 'UPDATE',
      'PATCH': 'UPDATE',
      'DELETE': 'DELETE'
    }
    return actionMap[method] || method
  }

  getResourceType(path) {
    // Extract resource type from path
    const match = path.match(/^/api/([^/]+)/)
    return match ? match[1] : 'unknown'
  }

  async enforceObligations(obligations = []) {
    for (const obligation of obligations) {
      const handler = this.obligationHandlers.get(obligation.type)

      if (!handler) {
        throw new Error(`No handler for obligation: ${obligation.type}`)
      }

      await handler(obligation)
    }
  }

  registerObligationHandler(type, handler) {
    this.obligationHandlers.set(type, handler)
  }
}

// Setup PEP with PDP
const pdp = new PolicyDecisionPoint(policyStore)
const pep = new PolicyEnforcementPoint(pdp)

// Register obligation handlers
pep.registerObligationHandler('audit-log', async (obligation) => {
  await auditLog.log({
    action: obligation.action,
    resource: obligation.resource,
    timestamp: new Date()
  })
})

pep.registerObligationHandler('notify-owner', async (obligation) => {
  await notificationService.send({
    to: obligation.ownerId,
    message: `Your resource ${obligation.resourceId} was accessed`
  })
})

pep.registerObligationHandler('require-mfa', async (obligation) => {
  if (!obligation.user.mfaVerified) {
    throw new Error('MFA verification required')
  }
})

// Apply PEP to routes
app.use('/api/documents', pep.middleware())
app.use('/api/sensitive', pep.middleware())

// Alternative: [Resource](https://reference.apios.info/terms/resource/)-specific PEP
class ResourcePEP {
  constructor(pdp, resourceType) {
    this.pdp = pdp
    this.resourceType = resourceType
  }

  async checkAccess(userId, resourceId, action) {
    const decision = await this.pdp.authorize({
      subject: { id: userId },
      resource: {
        id: resourceId,
        type: this.resourceType
      },
      action,
      environment: { time: new Date() }
    })

    if (decision.decision !== 'PERMIT') {
      throw new ForbiddenError(decision.reason)
    }

    return decision
  }
}

// Usage in business logic
const documentPEP = new ResourcePEP(pdp, 'document')

async function deleteDocument(userId, documentId) {
  // PEP check before business logic
  await documentPEP.checkAccess(userId, documentId, 'DELETE')

  // Proceed with deletion
  await db.documents.delete(documentId)
}