<commit_before>// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.

#include "require_capabilities.h"
#include "rpcrequest.h"
#include <vespa/fnet/connection.h>
#include <vespa/vespalib/net/connection_auth_context.h>
#include <vespa/vespalib/net/tls/capability_env_config.h>

#include <vespa/log/bufferedlogger.h>
LOG_SETUP(".fnet.frt.require_capabilities");

using namespace vespalib::net::tls;

bool
FRT_RequireCapabilities::allow(FRT_RPCRequest& req) const noexcept
{
    const auto& auth_ctx = req.GetConnection()->auth_context();
    const bool is_authorized = auth_ctx.capabilities().contains_all(_required_capabilities);
    if (is_authorized) {
        return true;
    } else {
        const auto mode = capability_enforcement_mode_from_env();
        if (mode == CapabilityEnforcementMode::Disable) {
            return true;
        }
        auto peer_spec = req.GetConnection()->GetPeerSpec();
        std::string method_name(req.GetMethodName(), req.GetMethodNameLen());
        LOGBT(warning, peer_spec, "%sPermission denied for RPC method '%s'. "
                                  "Peer at %s with %s. Call requires %s, but peer has %s",
              ((mode == CapabilityEnforcementMode::LogOnly) ? "(Dry-run only, not enforced): " : ""),
              method_name.c_str(), peer_spec.c_str(),
              to_string(auth_ctx.peer_credentials()).c_str(),
              _required_capabilities.to_string().c_str(),
              auth_ctx.capabilities().to_string().c_str());
        return (mode == CapabilityEnforcementMode::Enforce) ? false : true;
    }
}
<commit_msg>Simplify expression<commit_after>// Copyright Yahoo. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.

#include "require_capabilities.h"
#include "rpcrequest.h"
#include <vespa/fnet/connection.h>
#include <vespa/vespalib/net/connection_auth_context.h>
#include <vespa/vespalib/net/tls/capability_env_config.h>

#include <vespa/log/bufferedlogger.h>
LOG_SETUP(".fnet.frt.require_capabilities");

using namespace vespalib::net::tls;

bool
FRT_RequireCapabilities::allow(FRT_RPCRequest& req) const noexcept
{
    const auto& auth_ctx = req.GetConnection()->auth_context();
    const bool is_authorized = auth_ctx.capabilities().contains_all(_required_capabilities);
    if (is_authorized) {
        return true;
    } else {
        const auto mode = capability_enforcement_mode_from_env();
        if (mode == CapabilityEnforcementMode::Disable) {
            return true;
        }
        auto peer_spec = req.GetConnection()->GetPeerSpec();
        std::string method_name(req.GetMethodName(), req.GetMethodNameLen());
        LOGBT(warning, peer_spec, "%sPermission denied for RPC method '%s'. "
                                  "Peer at %s with %s. Call requires %s, but peer has %s",
              ((mode == CapabilityEnforcementMode::LogOnly) ? "(Dry-run only, not enforced): " : ""),
              method_name.c_str(), peer_spec.c_str(),
              to_string(auth_ctx.peer_credentials()).c_str(),
              _required_capabilities.to_string().c_str(),
              auth_ctx.capabilities().to_string().c_str());
        return (mode != CapabilityEnforcementMode::Enforce);
    }
}

{'fraction_non_alphanumeric': 0.12542061792597126, 'fraction_numerical': 0.001223615784643622, 'mean_word_length': 3.371657754010695, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 15, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6808532', 'n_tokens_mistral': 1003, 'n_tokens_neox': 984, 'n_words': 205}