feat: initial creation of allOf group auth

docs/configuration/uds-operator.md

@@ -20,7 +20,13 @@ The UDS Operator plays a pivotal role in managing the lifecycle of UDS Package C
   - In addition, the operator is responsible for generating Istio Virtual Services and the associated network policies for the ingress gateway.
 - **SSO Group Authentication:**
   - Group authentication determines who can access the application based on keycloak group membership.
-  - At this time `anyOf` allows defining a list of groups, a user must belong to at least one of them.
+  - Group definition types:
+    - `anyOf` defines a list of groups, a user must belong to at least one of them.
+    - `allOf` defines a list of groups, a user must belong to **all** of them.
+  - These definitions can be used together to create more complicated authentication rules.
+    {{% alert-caution %}}
+  Warning: **SSO Group Authentication** is in Alpha and may not be stable. Avoid using in production. Feedback is appreciated to improve reliability.
+    {{% /alert-caution %}}
 - **Authservice Protection:**
   - Authservice authentication provides application agnostic SSO for applications that opt-in.
   {{% alert-caution %}}

src/pepr/operator/controllers/keycloak/client-sync.spec.ts

@@ -139,7 +139,7 @@ describe("Test Secret & Template Data Generation", () => {
 });
 
 describe("handleClientGroups function", () => {
-  it('should correctly transform groups into attributes["uds.core.groups"]', () => {
+  it('should correctly transform anyOf groups into attributes["uds.core.groups"]', () => {
     // Arrange
     const ssoWithGroups: Sso = {
       clientId: "test-client",
@@ -164,6 +164,58 @@ describe("handleClientGroups function", () => {
     expect(ssoWithGroups.groups).toBeUndefined();
   });
 
+  it('should correctly transform alllOf groups into attributes["uds.core.groups"]', () => {
+    // Arrange
+    const ssoWithGroups: Sso = {
+      clientId: "test-client",
+      name: "Test Client",
+      redirectUris: ["https://example.com/callback"],
+      groups: {
+        allOf: ["group1", "group2"],
+      },
+    };
+
+    // Act
+    handleClientGroups(ssoWithGroups);
+
+    // Assert
+    expect(ssoWithGroups.attributes).toBeDefined();
+    expect(typeof ssoWithGroups.attributes).toBe("object");
+    expect(ssoWithGroups.attributes!["uds.core.groups"]).toEqual(
+      JSON.stringify({
+        allOf: ["group1", "group2"],
+      }),
+    );
+    expect(ssoWithGroups.groups).toBeUndefined();
+  });
+
+  it('should correctly transform alllOf and anyOf groups into attributes["uds.core.groups"]', () => {
+    // Arrange
+    const ssoWithGroups: Sso = {
+      clientId: "test-client",
+      name: "Test Client",
+      redirectUris: ["https://example.com/callback"],
+      groups: {
+        anyOf: ["group1", "group2"],
+        allOf: ["group3", "group4"],
+      },
+    };
+
+    // Act
+    handleClientGroups(ssoWithGroups);
+
+    // Assert
+    expect(ssoWithGroups.attributes).toBeDefined();
+    expect(typeof ssoWithGroups.attributes).toBe("object");
+    expect(ssoWithGroups.attributes!["uds.core.groups"]).toEqual(
+      JSON.stringify({
+        anyOf: ["group1", "group2"],
+        allOf: ["group3", "group4"],
+      }),
+    );
+    expect(ssoWithGroups.groups).toBeUndefined();
+  });
+
   it('should set attributes["uds.core.groups"] to an empty object if groups are not provided', () => {
     // Arrange
     const ssoWithoutGroups: Sso = {

src/pepr/operator/controllers/keycloak/client-sync.ts

@@ -174,7 +174,7 @@ async function syncClient(
  * @param clientReq - The client request object.
  */
 export function handleClientGroups(clientReq: Sso) {
-  if (clientReq.groups?.anyOf) {
+  if (clientReq.groups?.anyOf || clientReq.groups?.allOf) {
     clientReq.attributes = clientReq.attributes || {};
     clientReq.attributes["uds.core.groups"] = JSON.stringify(clientReq.groups);
   } else {

src/pepr/operator/crd/generated/package-v1alpha1.ts

@@ -593,6 +593,11 @@ export interface Groups {
    * List of groups allowed to access to client
    */
   anyOf?: string[];
+
+  /**
+   * List of groups required to access client
+   */
+  allOf?: string[];
 }
 
 /**

src/pepr/operator/crd/sources/package/v1alpha1.ts

@@ -358,6 +358,13 @@ const sso = {
               type: "string",
             },
           },
+          allOf: {
+            description: "List of groups required to access client",
+            type: "array",
+            items: {
+              type: "string",
+            },
+          },
         },
       },
     },