chromium/components/enterprise/data_controls/core/browser/rule.cc

// Copyright 2023 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "components/enterprise/data_controls/core/browser/rule.h"

#include <string_view>
#include <vector>

#include "base/containers/fixed_flat_map.h"
#include "base/feature_list.h"
#include "base/logging.h"
#include "base/strings/string_util.h"
#include "components/enterprise/data_controls/core/browser/conditions/and_condition.h"
#include "components/enterprise/data_controls/core/browser/conditions/attributes_condition.h"
#include "components/enterprise/data_controls/core/browser/conditions/not_condition.h"
#include "components/enterprise/data_controls/core/browser/conditions/or_condition.h"
#include "components/enterprise/data_controls/core/browser/features.h"
#include "components/policy/core/browser/policy_error_map.h"
#include "components/strings/grit/components_strings.h"

namespace data_controls {
namespace {

// Constants used to parse sub-dictionaries of DLP policies that should map to
// an AttributesCondition.
constexpr char kKeyName[] = …;
constexpr char kKeyRuleId[] = …;
constexpr char kKeyDescription[] = …;
constexpr char kKeySources[] = …;
constexpr char kKeyDestinations[] = …;
constexpr char kKeyRestrictions[] = …;
constexpr char kKeyAnd[] = …;
constexpr char kKeyOr[] = …;
constexpr char kKeyNot[] = …;
constexpr char kKeyClass[] = …;
constexpr char kKeyLevel[] = …;

// Helper to make dictionary parsing code more readable.
std::string GetStringOrEmpty(const base::Value::Dict& dict, const char* key) { … }

// A oneof attribute is an attribute that needs to be the only condition in
// their dictionary. If other attributes are present alongside them, it creates
// ambiguity as to how the rule is evaluated, and as such this is considered an
// error in the set policy.
std::vector<std::string_view> OneOfConditions(const base::Value::Dict& value) { … }

// Returns any condition present in `value` that wouldn't match
// `OneOfConditions`.
std::vector<std::string_view> AnyOfConditions(const base::Value::Dict& value) { … }

// Clones `error_path` and update the copy with a new value.
policy::PolicyErrorPath CreateErrorPath(
    const policy::PolicyErrorPath& error_path,
    std::string new_value,
    std::optional<int> new_list_index = std::nullopt) { … }

// Helper to check if a restriction is allowed to be applied to a rule given
// the currently enabled features.
bool IgnoreRestriction(Rule::Restriction restriction) { … }

}  // namespace

Rule::Rule(Rule&& other) = default;
Rule::~Rule() = default;

Rule::Rule(std::string name,
           std::string rule_id,
           std::string description,
           std::unique_ptr<const Condition> condition,
           base::flat_map<Restriction, Level> restrictions)
    : … { … }

// static
std::optional<Rule> Rule::Create(const base::Value& value) { … }

// static
std::optional<Rule> Rule::Create(const base::Value::Dict& value) { … }

Rule::Level Rule::GetLevel(Restriction restriction,
                           const ActionContext& context) const { … }

const std::string& Rule::name() const { … }

const std::string& Rule::rule_id() const { … }

const std::string& Rule::description() const { … }

// static
std::unique_ptr<const Condition> Rule::GetCondition(
    const base::Value::Dict& value) { … }

// static
std::unique_ptr<const Condition> Rule::GetSourcesAndDestinationsCondition(
    const base::Value::Dict& value) { … }

// static
std::vector<std::unique_ptr<const Condition>> Rule::GetListConditions(
    const base::Value::List& value) { … }

// static
base::flat_map<Rule::Restriction, Rule::Level> Rule::GetRestrictions(
    const base::Value::Dict& value) { … }

// static
Rule::Restriction Rule::StringToRestriction(const std::string& restriction) { … }

// static
Rule::Level Rule::StringToLevel(const std::string& level) { … }

// static
const char* Rule::RestrictionToString(Restriction restriction) { … }

// static
const char* Rule::LevelToString(Level level) { … }

// static
bool Rule::ValidateRuleValue(const char* policy_name,
                             const base::Value::Dict& root_value,
                             policy::PolicyErrorPath error_path,
                             policy::PolicyErrorMap* errors) { … }

// static
bool Rule::ValidateRuleSubValues(
    const char* policy_name,
    const base::Value::Dict& value,
    const base::flat_map<Rule::Restriction, Rule::Level>& restrictions,
    policy::PolicyErrorPath error_path,
    policy::PolicyErrorMap* errors) { … }

// static
void Rule::AddMutuallyExclusiveErrors(
    const std::vector<std::string_view>& oneof_conditions,
    const std::vector<std::string_view>& anyof_conditions,
    const char* policy_name,
    policy::PolicyErrorPath error_path,
    policy::PolicyErrorMap* errors) { … }

// static
bool Rule::AddUnsupportedAttributeErrors(
    const std::vector<std::string_view>& oneof_conditions,
    const std::vector<std::string_view>& anyof_conditions,
    base::flat_map<Rule::Restriction, Rule::Level> restrictions,
    const char* policy_name,
    policy::PolicyErrorPath error_path,
    policy::PolicyErrorMap* errors) { … }

// static
bool Rule::AddUnsupportedRestrictionErrors(
    const char* policy_name,
    const base::flat_map<Rule::Restriction, Rule::Level>& restrictions,
    policy::PolicyErrorPath error_path,
    policy::PolicyErrorMap* errors) { … }

}  // namespace data_controls