chore(ers): add BDD scenarios for condition operators equals, contains, regex

tests-bdd/features/ers-condition-and-logic.feature

@@ -0,0 +1,75 @@
+@ers-condition-and-logic @stateless
+Feature: ERS condition — multiple conditions AND logic
+  Validate that when a strategy has multiple JWT claim conditions, ALL
+  conditions must match for the strategy to be selected (AND logic).
+
+  Background:
+    Given an LDAP directory with test users
+    And an ERS configuration with mode "multi-strategy" and failure strategy "continue"
+    And an ERS provider "ldap_directory" of type "ldap" connected to the LDAP directory
+    And an ERS mapping strategy "multi_condition_strat" using provider "ldap_directory"
+      """
+      entity_type: subject
+      conditions:
+        jwt_claims:
+          - claim: userName
+            operator: contains
+            values: ["a"]
+          - claim: userName
+            operator: contains
+            values: ["di"]
+      ldap_search:
+        base_dn: "ou=users,dc=opentdf,dc=test"
+        filter: "(&(objectClass=inetOrgPerson)(uid={username}))"
+        scope: subtree
+        attributes: ["uid", "mail", "departmentNumber"]
+      input_mapping:
+        - jwt_claim: userName
+          parameter: username
+      output_mapping:
+        - source_attribute: departmentNumber
+          claim_name: department
+        - source_attribute: uid
+          claim_name: username
+      """
+    And a local platform with inline ERS configuration
+
+  Scenario: Both AND conditions match — diana contains "a" and "di" gets PERMIT
+    Given I submit a request to create a namespace with name "and-match.test" and reference id "ns_and_match"
+    And I send a request to create an attribute with:
+      | namespace_id  | name       | rule  | values                         |
+      | ns_and_match  | department | anyOf | engineering,marketing,security |
+    Then the response should be successful
+    Given a condition group referenced as "cg_and_match" with an "or" operator with conditions:
+      | selector_value | operator | values      |
+      | .department    | in       | engineering |
+    And a subject set referenced as "ss_and_match" containing the condition groups "cg_and_match"
+    And I send a request to create a subject condition set referenced as "scs_and_match" containing subject sets "ss_and_match"
+    And I send a request to create a subject mapping with:
+      | reference_id  | attribute_value                                           | condition_set_name | standard actions | custom actions |
+      | sm_and_match  | https://and-match.test/attr/department/value/engineering  | scs_and_match      | read             |                |
+    Then the response should be successful
+    Given there is a "user_name" subject entity with value "diana" and referenced as "diana_and"
+    When I send a decision request for entity chain "diana_and" for "read" action on resource "https://and-match.test/attr/department/value/engineering"
+    Then the response should be successful
+    And I should get a "PERMIT" decision response
+
+  Scenario: Only one AND condition matches — alice contains "a" but not "di" gets DENY
+    Given I submit a request to create a namespace with name "and-partial.test" and reference id "ns_and_partial"
+    And I send a request to create an attribute with:
+      | namespace_id    | name       | rule  | values                         |
+      | ns_and_partial  | department | anyOf | engineering,marketing,security |
+    Then the response should be successful
+    Given a condition group referenced as "cg_and_partial" with an "or" operator with conditions:
+      | selector_value | operator | values      |
+      | .department    | in       | engineering |
+    And a subject set referenced as "ss_and_partial" containing the condition groups "cg_and_partial"
+    And I send a request to create a subject condition set referenced as "scs_and_partial" containing subject sets "ss_and_partial"
+    And I send a request to create a subject mapping with:
+      | reference_id    | attribute_value                                              | condition_set_name | standard actions | custom actions |
+      | sm_and_partial  | https://and-partial.test/attr/department/value/engineering   | scs_and_partial    | read             |                |
+    Then the response should be successful
+    Given there is a "user_name" subject entity with value "alice" and referenced as "alice_and"
+    When I send a decision request for entity chain "alice_and" for "read" action on resource "https://and-partial.test/attr/department/value/engineering"
+    Then the response should be successful
+    And I should get a "DENY" decision response

tests-bdd/features/ers-condition-and-mixed.feature

@@ -0,0 +1,76 @@
+@ers-condition-and-mixed @stateless
+Feature: ERS condition — mixed operator AND logic
+  Validate that AND logic works across different operator types on the
+  same or different claims. A strategy with a regex condition plus a
+  contains condition requires both to match for selection.
+
+  Background:
+    Given an LDAP directory with test users
+    And an ERS configuration with mode "multi-strategy" and failure strategy "continue"
+    And an ERS provider "ldap_directory" of type "ldap" connected to the LDAP directory
+    And an ERS mapping strategy "mixed_ops_strat" using provider "ldap_directory"
+      """
+      entity_type: subject
+      conditions:
+        jwt_claims:
+          - claim: userName
+            operator: regex
+            values: ["^[a-d].*"]
+          - claim: userName
+            operator: contains
+            values: ["an"]
+      ldap_search:
+        base_dn: "ou=users,dc=opentdf,dc=test"
+        filter: "(&(objectClass=inetOrgPerson)(uid={username}))"
+        scope: subtree
+        attributes: ["uid", "mail", "departmentNumber"]
+      input_mapping:
+        - jwt_claim: userName
+          parameter: username
+      output_mapping:
+        - source_attribute: departmentNumber
+          claim_name: department
+        - source_attribute: uid
+          claim_name: username
+      """
+    And a local platform with inline ERS configuration
+
+  Scenario: Both mixed conditions match — diana matches regex "^[a-d].*" and contains "an" gets PERMIT
+    Given I submit a request to create a namespace with name "mixed-match.test" and reference id "ns_mixed_match"
+    And I send a request to create an attribute with:
+      | namespace_id    | name       | rule  | values                         |
+      | ns_mixed_match  | department | anyOf | engineering,marketing,security |
+    Then the response should be successful
+    Given a condition group referenced as "cg_mixed_match" with an "or" operator with conditions:
+      | selector_value | operator | values      |
+      | .department    | in       | engineering |
+    And a subject set referenced as "ss_mixed_match" containing the condition groups "cg_mixed_match"
+    And I send a request to create a subject condition set referenced as "scs_mixed_match" containing subject sets "ss_mixed_match"
+    And I send a request to create a subject mapping with:
+      | reference_id    | attribute_value                                              | condition_set_name | standard actions | custom actions |
+      | sm_mixed_match  | https://mixed-match.test/attr/department/value/engineering   | scs_mixed_match    | read             |                |
+    Then the response should be successful
+    Given there is a "user_name" subject entity with value "diana" and referenced as "diana_mixed"
+    When I send a decision request for entity chain "diana_mixed" for "read" action on resource "https://mixed-match.test/attr/department/value/engineering"
+    Then the response should be successful
+    And I should get a "PERMIT" decision response
+
+  Scenario: Regex matches but contains does not — alice matches "^[a-d].*" but not "an" gets DENY
+    Given I submit a request to create a namespace with name "mixed-partial.test" and reference id "ns_mixed_partial"
+    And I send a request to create an attribute with:
+      | namespace_id      | name       | rule  | values                         |
+      | ns_mixed_partial  | department | anyOf | engineering,marketing,security |
+    Then the response should be successful
+    Given a condition group referenced as "cg_mixed_partial" with an "or" operator with conditions:
+      | selector_value | operator | values      |
+      | .department    | in       | engineering |
+    And a subject set referenced as "ss_mixed_partial" containing the condition groups "cg_mixed_partial"
+    And I send a request to create a subject condition set referenced as "scs_mixed_partial" containing subject sets "ss_mixed_partial"
+    And I send a request to create a subject mapping with:
+      | reference_id      | attribute_value                                                | condition_set_name | standard actions | custom actions |
+      | sm_mixed_partial  | https://mixed-partial.test/attr/department/value/engineering   | scs_mixed_partial  | read             |                |
+    Then the response should be successful
+    Given there is a "user_name" subject entity with value "alice" and referenced as "alice_mixed"
+    When I send a decision request for entity chain "alice_mixed" for "read" action on resource "https://mixed-partial.test/attr/department/value/engineering"
+    Then the response should be successful
+    And I should get a "DENY" decision response

tests-bdd/features/ers-condition-contains.feature

@@ -0,0 +1,75 @@
+@ers-condition-contains @stateless
+Feature: ERS condition operator — contains
+  Validate that the "contains" condition operator performs case-insensitive
+  substring matching on JWT claims to select the correct mapping strategy.
+
+  The contains operator checks if a string claim value contains any of the
+  values in condition.Values[] as a substring (case-insensitive).
+
+  Background:
+    Given an LDAP directory with test users
+    And an ERS configuration with mode "multi-strategy" and failure strategy "continue"
+    And an ERS provider "ldap_directory" of type "ldap" connected to the LDAP directory
+    And an ERS mapping strategy "contains_ali_strat" using provider "ldap_directory"
+      """
+      entity_type: subject
+      conditions:
+        jwt_claims:
+          - claim: userName
+            operator: contains
+            values: ["ALI"]
+      ldap_search:
+        base_dn: "ou=users,dc=opentdf,dc=test"
+        filter: "(&(objectClass=inetOrgPerson)(uid={username}))"
+        scope: subtree
+        attributes: ["uid", "mail", "departmentNumber"]
+      input_mapping:
+        - jwt_claim: userName
+          parameter: username
+      output_mapping:
+        - source_attribute: departmentNumber
+          claim_name: department
+        - source_attribute: uid
+          claim_name: username
+      """
+    And a local platform with inline ERS configuration
+
+  Scenario: Contains condition matches substring case-insensitively — "alice" contains "ALI" gets PERMIT
+    Given I submit a request to create a namespace with name "ct-match.test" and reference id "ns_ct_match"
+    And I send a request to create an attribute with:
+      | namespace_id | name       | rule  | values                         |
+      | ns_ct_match  | department | anyOf | engineering,marketing,security |
+    Then the response should be successful
+    Given a condition group referenced as "cg_ct_match" with an "or" operator with conditions:
+      | selector_value | operator | values      |
+      | .department    | in       | engineering |
+    And a subject set referenced as "ss_ct_match" containing the condition groups "cg_ct_match"
+    And I send a request to create a subject condition set referenced as "scs_ct_match" containing subject sets "ss_ct_match"
+    And I send a request to create a subject mapping with:
+      | reference_id | attribute_value                                         | condition_set_name | standard actions | custom actions |
+      | sm_ct_match  | https://ct-match.test/attr/department/value/engineering | scs_ct_match       | read             |                |
+    Then the response should be successful
+    Given there is a "user_name" subject entity with value "alice" and referenced as "alice_ct"
+    When I send a decision request for entity chain "alice_ct" for "read" action on resource "https://ct-match.test/attr/department/value/engineering"
+    Then the response should be successful
+    And I should get a "PERMIT" decision response
+
+  Scenario: Contains condition does not match — "bob" does not contain "ALI" gets DENY
+    Given I submit a request to create a namespace with name "ct-nomatch.test" and reference id "ns_ct_nomatch"
+    And I send a request to create an attribute with:
+      | namespace_id   | name       | rule  | values                         |
+      | ns_ct_nomatch  | department | anyOf | engineering,marketing,security |
+    Then the response should be successful
+    Given a condition group referenced as "cg_ct_nomatch" with an "or" operator with conditions:
+      | selector_value | operator | values      |
+      | .department    | in       | engineering |
+    And a subject set referenced as "ss_ct_nomatch" containing the condition groups "cg_ct_nomatch"
+    And I send a request to create a subject condition set referenced as "scs_ct_nomatch" containing subject sets "ss_ct_nomatch"
+    And I send a request to create a subject mapping with:
+      | reference_id   | attribute_value                                            | condition_set_name | standard actions | custom actions |
+      | sm_ct_nomatch  | https://ct-nomatch.test/attr/department/value/engineering  | scs_ct_nomatch     | read             |                |
+    Then the response should be successful
+    Given there is a "user_name" subject entity with value "bob" and referenced as "bob_ct"
+    When I send a decision request for entity chain "bob_ct" for "read" action on resource "https://ct-nomatch.test/attr/department/value/engineering"
+    Then the response should be successful
+    And I should get a "DENY" decision response

tests-bdd/features/ers-condition-equals-ci.feature

@@ -0,0 +1,53 @@
+@ers-condition-equals-ci @stateless
+Feature: ERS condition operator — equals case-insensitivity
+  Validate that the "equals" condition operator is case-insensitive,
+  using strings.EqualFold so that condition value "ALICE" matches
+  userName "alice".
+
+  Background:
+    Given an LDAP directory with test users
+    And an ERS configuration with mode "multi-strategy" and failure strategy "continue"
+    And an ERS provider "ldap_directory" of type "ldap" connected to the LDAP directory
+    And an ERS mapping strategy "ci_alice_strat" using provider "ldap_directory"
+      """
+      entity_type: subject
+      conditions:
+        jwt_claims:
+          - claim: userName
+            operator: equals
+            values: ["ALICE"]
+      ldap_search:
+        base_dn: "ou=users,dc=opentdf,dc=test"
+        filter: "(&(objectClass=inetOrgPerson)(uid={username}))"
+        scope: subtree
+        attributes: ["uid", "mail", "departmentNumber"]
+      input_mapping:
+        - jwt_claim: userName
+          parameter: username
+      output_mapping:
+        - source_attribute: departmentNumber
+          claim_name: department
+        - source_attribute: uid
+          claim_name: username
+      """
+    And a local platform with inline ERS configuration
+
+  Scenario: Equals condition is case-insensitive — condition "ALICE" matches userName "alice"
+    Given I submit a request to create a namespace with name "eq-ci.test" and reference id "ns_eq_ci"
+    And I send a request to create an attribute with:
+      | namespace_id | name       | rule  | values                         |
+      | ns_eq_ci     | department | anyOf | engineering,marketing,security |
+    Then the response should be successful
+    Given a condition group referenced as "cg_eq_ci" with an "or" operator with conditions:
+      | selector_value | operator | values      |
+      | .department    | in       | engineering |
+    And a subject set referenced as "ss_eq_ci" containing the condition groups "cg_eq_ci"
+    And I send a request to create a subject condition set referenced as "scs_eq_ci" containing subject sets "ss_eq_ci"
+    And I send a request to create a subject mapping with:
+      | reference_id | attribute_value                                      | condition_set_name | standard actions | custom actions |
+      | sm_eq_ci     | https://eq-ci.test/attr/department/value/engineering | scs_eq_ci          | read             |                |
+    Then the response should be successful
+    Given there is a "user_name" subject entity with value "alice" and referenced as "alice_ci"
+    When I send a decision request for entity chain "alice_ci" for "read" action on resource "https://eq-ci.test/attr/department/value/engineering"
+    Then the response should be successful
+    And I should get a "PERMIT" decision response