Credentials: Define how rules are applied (match all or match any)

[MBadea17]

Currently, the way Ocean Node handles the web3 address-based access credentials is to allow access to everybody if no credentials are defined for an asset.

To increase the security of the assets shared using Ocean technology in enterprise-grade environments, we need to make the Ocean Node more restrictive when handling the assets with no address-based credentials defined. Therefore, the behavior of the Ocean Node needs to be updated as follows:

• if no address-based credentials are defined (both allow and deny lists are empty), access to the asset is restricted to everybody;
• to allow access to everybody, the symbol * will be used in the allow list;
• if a web3 address is present on both deny and allow lists, the deny list takes precedence, and access to the asset is denied for the respective address.

Also, the structure of the credentials object within the DDO needs to be updated to accommodate the credentials used by the newly added Policy Server component, as follows:

{
  "credentials": {
    "allow": [
      {
        "type": "address",
        "values": ["0x123", "0x456"]
      },
      {
	"type": "PS-specific Type",
	"values": [{}]
      }    
    ],
    "deny": [
      {
        "type": "address",
        "values": ["0x2222", "0x333"]
      }
    ]
  }
}

The "address" type object includes the addresses-based credentials (directly handled by Ocean Node) while the "PS-specific Type" object includes the credentials that the Policy Server will assess. The type of Policy Server access credentials will differ from one Policy Server implementation to another. For instance, the Policy Server developed for walt.id SSI stack will handle credentials of type "SSIpolicy".

[alexcos20]

The agreed structure will look like:

{
  "credentials": {
    "match_allow": "all",
    "match_deny": "any",
    "allow": [
      {
        "type": "address",
        "values": ["0x123", "0x456"]
      },
      {
	"type": "PS-specific Type",
	"values": [{}]
      }    
    ],
    "deny": [
      {
        "type": "address",
        "values": ["0x2222", "0x333"]
      }
    ]
  }
}

Where:

• match_allow is an optional parameter, which defines if it's enough to have one rule matched (match_allow: "any") or all allow rules should match (default value, if match_allow does not exists or it's different from 'any")
• match_deny follow same pattern as above, but default value is "any"

Deny lists are always checked first