updates to permisison string support

permissions/permission.go

···
 	"fmt"
 	"net/url"
 	"strings"
+	"unicode"
 
 	"github.com/bluesky-social/indigo/atproto/syntax"
 )
 
 var (
 	ErrInvalidPermissionSyntax = errors.New("invalid permission syntax")
-	ErrUnknownScope            = errors.New("unknown scope type")
+	ErrInvalidPermissionParams = errors.New("invalid permission parameters")
+	ErrUnknownResource         = errors.New("unknown permission resource")
 )
 
 type GenericPermission struct {
···
 	Resource string `json:"resource"`
 
 	// common params (eg, identity, account)
-	Attribute string   `json:"attr,omitempty"`
-	Action    []string `json:"action,omitempty"`
-	Audience  string   `json:"aud,omitempty"`
-
-	// repo
-	Collections []string `json:"collection,omitempty"`
-
-	// rpc
-	Endpoints []string `json:"lxm,omitempty"`
-
-	// blob
-	Accept []string `json:"accept,omitempty"`
-
-	// include
-	NSID string `json:"nsid,omitempty"`
+	Accept     []string `json:"accept,omitempty"`
+	Action     []string `json:"action,omitempty"`
+	Attribute  string   `json:"attr,omitempty"`
+	Audience   string   `json:"aud,omitempty"`
+	InheritAud bool     `json:"inheritAud,omitempty"`
+	Collection []string `json:"collection,omitempty"`
+	Endpoint   []string `json:"lxm,omitempty"`
+	NSID       string   `json:"nsid,omitempty"`
 }
 
-func (p *Permission) Scope() string {
+func (p *Permission) ScopeString() string {
 
 	positional := ""
 	params := make(url.Values)
···
 			params.Set("aud", p.Audience)
 		}
 	case "repo":
-		if len(p.Collections) == 1 {
-			positional = p.Collections[0]
-		} else if len(p.Collections) > 1 {
-			params["collection"] = p.Collections
+		if len(p.Collection) == 1 {
+			positional = p.Collection[0]
+		} else if len(p.Collection) > 1 {
+			params["collection"] = p.Collection
 		}
 		if len(p.Action) != 0 {
 			params["action"] = p.Action
 		}
 	case "rpc":
-		if len(p.Endpoints) == 1 {
-			positional = p.Endpoints[0]
-		} else if len(p.Endpoints) > 1 {
-			params["lxm"] = p.Endpoints
+		if len(p.Endpoint) == 1 {
+			positional = p.Endpoint[0]
+		} else if len(p.Endpoint) > 1 {
+			params["lxm"] = p.Endpoint
 		}
 		if p.Audience != "" {
 			params.Set("aud", p.Audience)
···
 
 func ParseGenericScope(scope string) (*GenericPermission, error) {
 
+	if !isASCII(scope) {
+		return nil, ErrInvalidPermissionSyntax
+	}
+
 	front, query, _ := strings.Cut(scope, "?")
 	resource, positional, _ := strings.Cut(front, ":")
+
+	// XXX: more charset restrictions
 
 	params, err := url.ParseQuery(query)
 	if err != nil {
···
 	return &p, nil
 }
 
-// TODO: improve this function
+// TODO: improve this function, add tests
 func validBlobAccept(accept string) bool {
 	if accept == "*/*" {
 		return true
···
 	return true
 }
 
-// TODO: improve this function
+// TODO: improve this function, add tests
 func validServiceRef(accept string) bool {
 	parts := strings.SplitN(accept, "#", 3)
 	if len(parts) != 2 {
···
 	return true
 }
 
-func ParseScope(scope string) (*Permission, error) {
+func ParsePermissionString(scope string) (*Permission, error) {
 	g, err := ParseGenericScope(scope)
 	if err != nil {
 		return nil, err
···
 	case "account":
 		for k, _ := range g.Params {
 			if !(k == "attr" || k == "action") {
-				return nil, fmt.Errorf("%w: unexpected param: %s", ErrInvalidPermissionSyntax, k)
+				return nil, fmt.Errorf("%w: unsupported 'account' param: %s", ErrInvalidPermissionParams, k)
 			}
 		}
 		if g.Params.Has("attr") {
 			if g.Positional != "" || len(g.Params["attr"]) != 1 {
-				return nil, ErrInvalidPermissionSyntax
+				return nil, ErrInvalidPermissionParams
 			}
 			p.Attribute = g.Params.Get("attr")
 		}
···
 			p.Attribute = g.Positional
 		}
 		if p.Attribute == "" {
-			return nil, ErrInvalidPermissionSyntax
+			return nil, ErrInvalidPermissionParams
 		}
 		if p.Attribute != "" && p.Attribute != "email" && p.Attribute != "repo" {
-			return nil, ErrInvalidPermissionSyntax
+			return nil, ErrInvalidPermissionParams
 		}
+		// TODO: maybe this should not be limited to a single "action" string?
 		if len(g.Params["action"]) > 1 {
-			return nil, ErrInvalidPermissionSyntax
+			return nil, ErrInvalidPermissionParams
 		}
 		p.Action = g.Params["action"]
 		for _, act := range p.Action {
 			if act != "read" && act != "manage" {
-				return nil, ErrInvalidPermissionSyntax
+				return nil, ErrInvalidPermissionParams
 			}
 		}
 	case "blob":
 		for k, _ := range g.Params {
 			if !(k == "accept") {
-				return nil, fmt.Errorf("%w: unexpected param: %s", ErrInvalidPermissionSyntax, k)
+				return nil, fmt.Errorf("%w: unsupported 'blob' param: %s", ErrInvalidPermissionParams, k)
 			}
 		}
 		if g.Params.Has("accept") {
 			if g.Positional != "" {
-				return nil, ErrInvalidPermissionSyntax
+				return nil, ErrInvalidPermissionParams
 			}
 			p.Accept = g.Params["accept"]
 		}
···
 			p.Accept = []string{g.Positional}
 		}
 		if len(p.Accept) == 0 {
-			return nil, ErrInvalidPermissionSyntax
+			return nil, ErrInvalidPermissionParams
 		}
 		for _, acc := range p.Accept {
 			if !validBlobAccept(acc) {
-				return nil, ErrInvalidPermissionSyntax
+				return nil, ErrInvalidPermissionParams
 			}
 		}
 	case "identity":
 		for k, _ := range g.Params {
 			if !(k == "attr") {
-				return nil, fmt.Errorf("%w: unexpected param: %s", ErrInvalidPermissionSyntax, k)
+				return nil, fmt.Errorf("%w: unsupported 'identity' param: %s", ErrInvalidPermissionParams, k)
 			}
 		}
 		if g.Params.Has("attr") {
 			if g.Positional != "" || len(g.Params["attr"]) != 1 {
-				return nil, ErrInvalidPermissionSyntax
+				return nil, ErrInvalidPermissionParams
 			}
 			p.Attribute = g.Params.Get("attr")
 		}
···
 			p.Attribute = g.Positional
 		}
 		if p.Attribute != "*" && p.Attribute != "handle" {
-			return nil, ErrInvalidPermissionSyntax
+			return nil, ErrInvalidPermissionParams
 		}
 	case "include":
 		for k, _ := range g.Params {
 			if !(k == "nsid" || k == "aud") {
-				return nil, fmt.Errorf("%w: unexpected param: %s", ErrInvalidPermissionSyntax, k)
+				return nil, fmt.Errorf("%w: unsupported 'include' param: %s", ErrInvalidPermissionParams, k)
 			}
 		}
 		if g.Params.Has("nsid") {
 			if g.Positional != "" || len(g.Params["nsid"]) != 1 {
-				return nil, ErrInvalidPermissionSyntax
+				return nil, ErrInvalidPermissionParams
 			}
 			p.NSID = g.Params.Get("nsid")
 		}
···
 		}
 		_, err := syntax.ParseNSID(p.NSID)
 		if err != nil {
-			return nil, fmt.Errorf("%w: %w", ErrInvalidPermissionSyntax, err)
+			return nil, fmt.Errorf("%w: %w", ErrInvalidPermissionParams, err)
 		}
 		if g.Params.Has("aud") && (len(g.Params["aud"]) != 1 || g.Params.Get("aud") == "") {
-			return nil, ErrInvalidPermissionSyntax
+			return nil, ErrInvalidPermissionParams
 		}
 		p.Audience = g.Params.Get("aud")
 		if p.Audience != "" && p.Audience != "*" && !validServiceRef(p.Audience) {
-			return nil, ErrInvalidPermissionSyntax
+			return nil, ErrInvalidPermissionParams
 		}
 		// possibly other params in the future...
 	case "repo":
 		for k, _ := range g.Params {
 			if !(k == "collection" || k == "action") {
-				return nil, fmt.Errorf("%w: unexpected param: %s", ErrInvalidPermissionSyntax, k)
+				return nil, fmt.Errorf("%w: unsupported 'repo' param: %s", ErrInvalidPermissionParams, k)
 			}
 		}
 		if g.Params.Has("collection") {
 			if g.Positional != "" {
-				return nil, ErrInvalidPermissionSyntax
+				return nil, ErrInvalidPermissionParams
 			}
-			p.Collections = g.Params["collection"]
+			p.Collection = g.Params["collection"]
 		}
 		if g.Positional != "" {
-			p.Collections = []string{g.Positional}
+			p.Collection = []string{g.Positional}
 		}
-		if len(p.Collections) == 0 {
-			return nil, ErrInvalidPermissionSyntax
+		if len(p.Collection) == 0 {
+			return nil, ErrInvalidPermissionParams
 		}
-		for _, coll := range p.Collections {
+		for _, coll := range p.Collection {
 			if coll == "*" {
 				continue
 			}
 			_, err := syntax.ParseNSID(coll)
 			if err != nil {
-				return nil, fmt.Errorf("%w: %w", ErrInvalidPermissionSyntax, err)
+				return nil, fmt.Errorf("%w: %w", ErrInvalidPermissionParams, err)
 			}
 		}
 		p.Action = g.Params["action"]
 		for _, act := range p.Action {
 			if act != "create" && act != "update" && act != "delete" {
-				return nil, ErrInvalidPermissionSyntax
+				return nil, ErrInvalidPermissionParams
 			}
 		}
 	case "rpc":
 		for k, _ := range g.Params {
 			if !(k == "lxm" || k == "aud") {
-				return nil, fmt.Errorf("%w: unexpected param: %s", ErrInvalidPermissionSyntax, k)
+				return nil, fmt.Errorf("%w: unsupported 'rpc' param: %s", ErrInvalidPermissionParams, k)
 			}
 		}
 		if g.Params.Has("lxm") {
 			if g.Positional != "" {
-				return nil, ErrInvalidPermissionSyntax
+				return nil, ErrInvalidPermissionParams
 			}
-			p.Endpoints = g.Params["lxm"]
+			p.Endpoint = g.Params["lxm"]
 		}
 		if g.Positional != "" {
-			p.Endpoints = []string{g.Positional}
+			p.Endpoint = []string{g.Positional}
 		}
-		if len(p.Endpoints) == 0 {
-			return nil, ErrInvalidPermissionSyntax
+		if len(p.Endpoint) == 0 {
+			return nil, ErrInvalidPermissionParams
 		}
 		if len(g.Params["aud"]) != 1 {
-			return nil, ErrInvalidPermissionSyntax
+			return nil, ErrInvalidPermissionParams
 		}
 		p.Audience = g.Params.Get("aud")
-		for _, nsid := range p.Endpoints {
+		for _, nsid := range p.Endpoint {
 			if nsid == "*" {
 				if p.Audience == "*" {
-					return nil, ErrInvalidPermissionSyntax
+					return nil, ErrInvalidPermissionParams
 				}
 				continue
 			}
 			_, err := syntax.ParseNSID(nsid)
 			if err != nil {
-				return nil, fmt.Errorf("%w: %w", ErrInvalidPermissionSyntax, err)
+				return nil, fmt.Errorf("%w: %w", ErrInvalidPermissionParams, err)
 			}
 		}
 		if p.Audience != "*" && !validServiceRef(p.Audience) {
-			return nil, ErrInvalidPermissionSyntax
+			return nil, ErrInvalidPermissionParams
 		}
 	default:
-		return nil, ErrUnknownScope
+		return nil, fmt.Errorf("%w: %s", ErrUnknownResource, g.Resource)
 	}
 	return &p, nil
 }
+
+func isASCII(s string) bool {
+	for i := 0; i < len(s); i++ {
+		if s[i] > unicode.MaxASCII {
+			return false
+		}
+	}
+	return true
+}

permissions/permission_test.go

···
 	}
 
 	for _, scope := range testScopes {
-		p, err := ParseScope(scope)
+		p, err := ParsePermissionString(scope)
 		assert.NoError(err)
 		if err != nil {
 			fmt.Println("BAD: " + scope)
 			continue
 		}
-		assert.Equal(scope, p.Scope())
+		assert.Equal(scope, p.ScopeString())
 	}
 }
 
···
 	Generic GenericPermission `json:"generic"`
 }
 
-func TestGenericPermissions(t *testing.T) {
+func TestGenericGenericScopesValid(t *testing.T) {
 	assert := assert.New(t)
 	file, err := os.Open("testdata/generic_scopes.json")
 	if err != nil {
···
 	}
 }
 
+func TestGenericScopesInvalid(t *testing.T) {
+	assert := assert.New(t)
+	file, err := os.Open("testdata/generic_scopes_invalid.txt")
+	if err != nil {
+		assert.NoError(err)
+		t.Fail()
+	}
+	defer file.Close()
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if len(line) == 0 || line[0] == '#' {
+			continue
+		}
+		_, err := ParseGenericScope(line)
+		if err != nil {
+			fmt.Println("BAD: " + line)
+		}
+		assert.Error(err)
+	}
+	assert.NoError(scanner.Err())
+}
+
 func TestInteropPermissionValid(t *testing.T) {
 	assert := assert.New(t)
 	file, err := os.Open("testdata/permission_scopes_valid.txt")
···
 			fmt.Println("BAD: " + line)
 		}
 		assert.NoError(err)
-		p, err := ParseScope(line)
+		p, err := ParsePermissionString(line)
 		if err != nil {
 			fmt.Println("BAD: " + line)
 		}
 		assert.NoError(err)
 		if p != nil {
-			assert.False(p.Scope() == "")
+			assert.False(p.ScopeString() == "")
 		}
 	}
 	assert.NoError(scanner.Err())
···
 		if len(line) == 0 || line[0] == '#' {
 			continue
 		}
-		_, err := ParseScope(line)
+		_, err := ParsePermissionString(line)
 		if err == nil {
 			fmt.Println("BAD: " + line)
 		}

permissions/testdata/generic_scopes.json

···
 [
     {
+        "scope": "resource",
+        "generic": {
+            "resource": "resource",
+            "positional": "",
+            "params": {}
+        }
+    },
+    {
+        "scope": "resource:positional?key=val",
+        "generic": {
+            "resource": "resource",
+            "positional": "positional",
+            "params": {
+              "key": ["val"]
+            }
+        }
+    },
+    {
+        "scope": "resource:positional?thing&key=val",
+        "generic": {
+            "resource": "resource",
+            "positional": "positional",
+            "params": {
+              "thing": [""],
+              "key": ["val"]
+            }
+        }
+    },
+    {
+        "scope": "service:did:web:com.example#type?key=val",
+        "generic": {
+            "resource": "service",
+            "positional": "did:web:com.example#type",
+            "params": {
+              "key": ["val"]
+            }
+        }
+    },
+    {
+        "scope": "resource:",
+        "generic": {
+            "resource": "resource",
+            "positional": "",
+            "params": {}
+        }
+    },
+    {
+        "scope": "resource:?",
+        "generic": {
+            "resource": "resource",
+            "positional": "",
+            "params": {}
+        }
+    },
+    {
+        "scope": "resource:&",
+        "generic": {
+            "resource": "resource",
+            "positional": "&",
+            "params": {}
+        }
+    },
+    {
+        "scope": "resource?",
+        "generic": {
+            "resource": "resource",
+            "positional": "",
+            "params": {}
+        }
+    },
+    {
         "scope": "res:pos?p=true",
         "generic": {
             "resource": "res",

permissions/testdata/generic_scopes_SKIP.json

···
-[
-    {
-        "scope": "my-res:my%20pos",
-        "generic": {
-            "resource": "my-res",
-            "positional": "my pos",
-            "params": {}
-        }
-    }
-]

permissions/testdata/generic_scopes_invalid.txt

···
+resource:positional?key=québec
+emoji:☺️

permissions/testdata/permission_scopes_valid.txt

···
 rpc?aud=*&lxm=com.example.method1&lxm=com.example.method2
 rpc:com.example.query?aud=did:web:api.example.com%23api_example
 rpc?aud=did%3Aweb%3Aapi.example.com%23frag&lxm=com.example.query&lxm=com.example.procedure
+
+
+# examples from specification text 
+repo:app.example.profile
+repo:app.example.profile?action=create&action=update&action=delete
+repo?collection=app.example.profile&collection=app.example.post
+repo:*
+repo:*?action=delete
+rpc:app.example.moderation.createReport?aud=*
+rpc?lxm=*&aud=did:web:api.example.com%23svc_appview
+blob:*/*
+blob?accept=video/*&accept=text/html
+account:email
+account:repo?action=manage
+identity:handle
+identity:*
+identity:*?
+rpc?lxm=*&aud=did:web:api.example.com%23svc_appview
+blob?accept=video/*&accept=text/html
+repo:app.example.profile?action=create&action=update&action=delete
+include:app.example.authFull?aud=did:web:api.example.com%23svc_chat