[java-shib-attribute] 01/02: JSATTR-39 Implement wildcard support in attribute filter

[Rod Widdowson]

This is an automated email from the git hooks/post-receive script.

rdw pushed a commit to branch main
in repository java-shib-attribute.

View the commit online:
http://git.shibboleth.net/view/?p=java-shib-attribute.git;a=commit;h=badda0dd86e67e39f4b69c061512123f9b1b2bf8

commit badda0dd86e67e39f4b69c061512123f9b1b2bf8
Author: Rod Widdowson <rdw at steadingsoftware.com>
AuthorDate: Thu Apr 17 09:46:22 2025 +0100

    JSATTR-39 Implement wildcard support in attribute filter
    
    https://shibboleth.atlassian.net/browse/JSATTR-39
    
    Add a set into the work context to accumulate every attribute ID as it is filtered.
---
 .../attribute/filter/AttributeFilterPolicy.java    |  6 ++++++
 .../filter/context/AttributeFilterWorkContext.java | 20 +++++++++++++++++-
 .../context/AttributeFilterWorkContextTest.java    | 24 ++++++++++++++++++----
 3 files changed, 45 insertions(+), 5 deletions(-)

diff --git a/shib-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/AttributeFilterPolicy.java b/shib-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/AttributeFilterPolicy.java
index a4d266900..0dc5b9f4d 100644
--- a/shib-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/AttributeFilterPolicy.java
+++ b/shib-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/AttributeFilterPolicy.java
@@ -27,6 +27,7 @@ import org.slf4j.Logger;
 import net.shibboleth.idp.attribute.IdPAttribute;
 import net.shibboleth.idp.attribute.filter.PolicyRequirementRule.Tristate;
 import net.shibboleth.idp.attribute.filter.context.AttributeFilterContext;
+import net.shibboleth.idp.attribute.filter.context.AttributeFilterWorkContext;
 import net.shibboleth.shared.annotation.ParameterName;
 import net.shibboleth.shared.annotation.constraint.NotEmpty;
 import net.shibboleth.shared.annotation.constraint.NotLive;
@@ -139,6 +140,10 @@ public final class AttributeFilterPolicy extends AbstractIdentifiedInitializable
 
         Constraint.isNotNull(filterContext, "Attribute filter context can not be null");
 
+        final AttributeFilterWorkContext filterWorkContext = Constraint.isNotNull(
+                filterContext.getSubcontext(AttributeFilterWorkContext.class),
+                "Attribute filter work context can not be null");
+
         if (!isApplicable(filterContext)) {
             return;
         }
@@ -149,6 +154,7 @@ public final class AttributeFilterPolicy extends AbstractIdentifiedInitializable
 
         IdPAttribute attribute;
         for (final AttributeRule valuePolicy : valuePolicies) {
+            filterWorkContext.addFilteredAttributeId(valuePolicy.getAttributeId());
             attribute = attributes.get(valuePolicy.getAttributeId());
             if (attribute != null) {
                 if (!attribute.getValues().isEmpty()) {
diff --git a/shib-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterWorkContext.java b/shib-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterWorkContext.java
index 3078c217e..643117ca0 100644
--- a/shib-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterWorkContext.java
+++ b/shib-attribute-filter-api/src/main/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterWorkContext.java
@@ -16,6 +16,7 @@ package net.shibboleth.idp.attribute.filter.context;
 
 import java.util.Collection;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.LinkedHashSet;
 import java.util.Map;
 import java.util.Set;
@@ -53,10 +54,14 @@ public final class AttributeFilterWorkContext extends BaseContext {
     /** Values, for a given attribute, that are not permitted to be released. */
     @Nonnull private final Map<String, Set<IdPAttributeValue>> deniedValues;
 
+    /** List of all Attribute names mentioned by a AttributeRule inside an active PolicyRule. */
+    @Nonnull private final Set<String> filteredAttributeIds;
+
     /** Constructor. */
     public AttributeFilterWorkContext() {
         permittedValues = new HashMap<>();
         deniedValues = new HashMap<>();
+        filteredAttributeIds = new HashSet<>();
     }
 
     /**
@@ -177,4 +182,17 @@ public final class AttributeFilterWorkContext extends BaseContext {
         }
     }
 
-}
\ No newline at end of file
+    /** Register an attribute ID as having been considered for filtering.
+     * @param attributeId the ID
+     */
+    public void addFilteredAttributeId(@Nonnull final String attributeId) {
+        filteredAttributeIds.add(attributeId);
+    }
+
+    /** Return all the attribute ids for activated AttributeRules.
+     * @return the set made up from multiple calls to {@link #addFilteredAttributeId(String)}
+     */
+    @Nonnull public Set<String> getFilteredAttributeIds() {
+        return filteredAttributeIds;
+    }
+}
diff --git a/shib-attribute-filter-api/src/test/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterWorkContextTest.java b/shib-attribute-filter-api/src/test/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterWorkContextTest.java
index 241bdcff0..a070b5b3b 100644
--- a/shib-attribute-filter-api/src/test/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterWorkContextTest.java
+++ b/shib-attribute-filter-api/src/test/java/net/shibboleth/idp/attribute/filter/context/AttributeFilterWorkContextTest.java
@@ -14,6 +14,9 @@
 
 package net.shibboleth.idp.attribute.filter.context;
 
+import static org.testng.Assert.assertEquals;
+import static org.testng.Assert.assertTrue;
+
 import java.util.ArrayList;
 import java.util.Arrays;
 
@@ -101,16 +104,16 @@ public class AttributeFilterWorkContextTest {
         parent.setPrefilteredIdPAttributes(CollectionSupport.singletonList(attribute1));
 
         context.addDeniedIdPAttributeValues("one", CollectionSupport.singletonList(aStringAttributeValue));
-        Assert.assertEquals(context.getDeniedAttributeValues().get("one").size(), 1);
+        assertEquals(context.getDeniedAttributeValues().get("one").size(), 1);
 
         context.addDeniedIdPAttributeValues("one", null);
-        Assert.assertEquals(context.getDeniedAttributeValues().get("one").size(), 1);
+        assertEquals(context.getDeniedAttributeValues().get("one").size(), 1);
 
         context.addDeniedIdPAttributeValues("one", new ArrayList<IdPAttributeValue>());
-        Assert.assertEquals(context.getDeniedAttributeValues().get("one").size(), 1);
+        assertEquals(context.getDeniedAttributeValues().get("one").size(), 1);
 
         context.addDeniedIdPAttributeValues("one", CollectionSupport.singletonList(bStringAttributeValue));
-        Assert.assertEquals(context.getDeniedAttributeValues().get("one").size(), 2);
+        assertEquals(context.getDeniedAttributeValues().get("one").size(), 2);
 
         try {
             context.addDeniedIdPAttributeValues("", CollectionSupport.singletonList(bStringAttributeValue));
@@ -134,4 +137,17 @@ public class AttributeFilterWorkContextTest {
         }
     }
     
+    @Test public void testFilteredAttriutes() {
+
+        final AttributeFilterContext parent = new AttributeFilterContext();
+        final AttributeFilterWorkContext context = parent.ensureSubcontext(AttributeFilterWorkContext.class);
+
+        assertTrue(context.getFilteredAttributeIds().isEmpty());
+
+        context.addFilteredAttributeId("one");
+        context.addFilteredAttributeId("two");
+        context.addFilteredAttributeId("one");
+
+        assertEquals(context.getFilteredAttributeIds().size(), 2);
+    }
 }

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.