feat: Add Azure RBAC condition parser (microsoft#496)

* feat: Add Azure RBAC condition parser

- declare an `azure-rbac` feature and expose the Azure RBAC module with parser, AST, and YAML-driven tests
- extend the shared lexer with RBAC-specific tokens, single-quoted strings, and corrected raw-string spans
- verify the parser via comprehensive test cases covering every operator and complex chaining

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>



---------

Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>

Author: anakrish

.github/workflows/pr.yml

@@ -49,3 +49,5 @@ jobs:
     - name: Run tests (Azure Policy)
       run: >-
         cargo test --frozen --features azure_policy
+    - name: Run tests (Azure RBAC)
+      run: cargo test -r --frozen --features azure-rbac

.github/workflows/tests-debug.yml

@@ -42,3 +42,5 @@ jobs:
     - name: Run tests (OPA Conformance)
       run: >-
         cargo test --test opa --frozen --features opa-testutil,serde_json/arbitrary_precision  -- $(tr '\n' ' ' < tests/opa.passing)
+    - name: Run tests (Azure RBAC)
+      run: cargo test --frozen --features azure-rbac

Cargo.toml

@@ -25,6 +25,7 @@ default = ["full-opa", "arc", "rvm"]
 arc = ["scientific/arc"]
 ast = []
 azure_policy = ["dep:jsonschema", "arc", "dashmap"]
+azure-rbac = []
 base64 = ["dep:data-encoding"]
 base64url = ["dep:data-encoding"]
 coverage = []

src/languages/azure_rbac/ast/context.rs

@@ -0,0 +1,61 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use alloc::string::String;
+use serde::{Deserialize, Serialize};
+
+use crate::value::Value;
+
+/// Principal type
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub enum PrincipalType {
+    User,
+    Group,
+    ServicePrincipal,
+    ManagedServiceIdentity,
+}
+
+/// Evaluation context - what information is available when evaluating RBAC policies
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct EvaluationContext {
+    pub principal: Principal,
+    pub resource: Resource,
+    pub request: RequestContext,
+    pub environment: EnvironmentContext,
+    pub action: Option<String>,
+    pub suboperation: Option<String>,
+}
+
+/// Principal information (user, group, service principal, etc.)
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct Principal {
+    pub id: String,
+    pub principal_type: PrincipalType,
+    pub custom_security_attributes: Value,
+}
+
+/// Resource information
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct Resource {
+    pub id: String,
+    pub resource_type: String,
+    pub scope: String,
+    pub attributes: Value,
+}
+
+/// Request context information
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct RequestContext {
+    pub action: Option<String>,
+    pub data_action: Option<String>,
+    pub attributes: Value,
+}
+
+/// Environment context information
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct EnvironmentContext {
+    pub is_private_link: Option<bool>,
+    pub private_endpoint: Option<String>,
+    pub subnet: Option<String>,
+    pub utc_now: Option<String>,
+}

src/languages/azure_rbac/ast/expr.rs

@@ -0,0 +1,171 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use alloc::boxed::Box;
+use alloc::string::String;
+use alloc::vec::Vec;
+use serde::{Deserialize, Serialize};
+
+use super::literals::{
+    BooleanLiteral, DateTimeLiteral, NullLiteral, NumberLiteral, StringLiteral, TimeLiteral,
+};
+use super::operators::{ArrayOperator, ConditionOperator};
+use super::references::AttributeReference;
+use super::span::EmptySpan;
+
+/// ABAC condition expression
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ConditionExpression {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub raw_expression: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub expression: Option<ConditionExpr>,
+}
+
+impl ConditionExpression {
+    pub fn new(span: EmptySpan, expression: String) -> Self {
+        Self {
+            span,
+            raw_expression: expression,
+            expression: None,
+        }
+    }
+
+    pub fn with_parsed(span: EmptySpan, raw_expression: String, parsed: ConditionExpr) -> Self {
+        Self {
+            span,
+            raw_expression,
+            expression: Some(parsed),
+        }
+    }
+}
+
+/// Condition expression node
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+#[serde(tag = "type")]
+pub enum ConditionExpr {
+    Logical(LogicalExpression),
+    Unary(UnaryExpression),
+    Binary(BinaryExpression),
+    FunctionCall(FunctionCallExpression),
+    AttributeReference(AttributeReference),
+    ArrayExpression(ArrayExpression),
+    Identifier(IdentifierExpression),
+    VariableReference(VariableReference),
+    PropertyAccess(PropertyAccessExpression),
+    StringLiteral(StringLiteral),
+    NumberLiteral(NumberLiteral),
+    BooleanLiteral(BooleanLiteral),
+    NullLiteral(NullLiteral),
+    DateTimeLiteral(DateTimeLiteral),
+    TimeLiteral(TimeLiteral),
+    SetLiteral(SetLiteral),
+    ListLiteral(ListLiteral),
+}
+
+/// Logical (AND/OR) expression
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct LogicalExpression {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub operator: LogicalOperator,
+    pub left: Box<ConditionExpr>,
+    pub right: Box<ConditionExpr>,
+}
+
+/// Logical operator kinds
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub enum LogicalOperator {
+    And,
+    Or,
+}
+
+/// Unary expression (e.g., NOT)
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct UnaryExpression {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub operator: UnaryOperator,
+    pub operand: Box<ConditionExpr>,
+}
+
+/// Unary operator kinds
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub enum UnaryOperator {
+    Not,
+    Exists,
+    NotExists,
+}
+
+/// Binary expression with an operator and two operands
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct BinaryExpression {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub operator: ConditionOperator,
+    pub left: Box<ConditionExpr>,
+    pub right: Box<ConditionExpr>,
+}
+
+/// Function call expression (e.g. ToLower(expr))
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct FunctionCallExpression {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub function: String,
+    pub arguments: Vec<ConditionExpr>,
+}
+
+/// Array expression with quantifiers (e.g. ANY tag : ...)
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ArrayExpression {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub operator: ArrayOperator,
+    pub array: Box<ConditionExpr>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub variable: Option<String>,
+    pub condition: Box<ConditionExpr>,
+}
+
+/// Set literal value (e.g. {'a', 'b'})
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct SetLiteral {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub elements: Vec<ConditionExpr>,
+}
+
+/// List literal value (e.g. ['start', 'end'])
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct ListLiteral {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub elements: Vec<ConditionExpr>,
+}
+
+/// Identifier expression (unqualified name)
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct IdentifierExpression {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub name: String,
+}
+
+/// Variable reference (e.g. loop variable in ANY clauses)
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct VariableReference {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub name: String,
+}
+
+/// Property access expression (e.g. tag.key)
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct PropertyAccessExpression {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub object: Box<ConditionExpr>,
+    pub property: String,
+}

src/languages/azure_rbac/ast/literals.rs

@@ -0,0 +1,56 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+use alloc::string::String;
+use serde::{Deserialize, Serialize};
+
+use super::span::EmptySpan;
+
+/// String literal value
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct StringLiteral {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub value: String,
+}
+
+/// Number literal value (keeps raw representation)
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct NumberLiteral {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub raw: String,
+}
+
+/// Boolean literal value
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct BooleanLiteral {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub value: bool,
+}
+
+/// Null literal
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct NullLiteral {
+    #[serde(skip)]
+    pub span: EmptySpan,
+}
+
+/// Date-time literal value (ISO-8601 formatted)
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct DateTimeLiteral {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub value: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub normalized: Option<String>,
+}
+
+/// Time literal value (HH:MM or HH:MM:SS)
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct TimeLiteral {
+    #[serde(skip)]
+    pub span: EmptySpan,
+    pub value: String,
+}

src/languages/azure_rbac/ast/mod.rs

@@ -0,0 +1,16 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+pub mod context;
+pub mod expr;
+pub mod literals;
+pub mod operators;
+pub mod references;
+pub mod span;
+
+pub use context::*;
+pub use expr::*;
+pub use literals::*;
+pub use operators::*;
+pub use references::*;
+pub use span::*;