Built-in Libraries

rule CheckBusinessHours {
    when {
        const now = DateTime.Now();
        const hour = now.ToUnit(TimeUnit.Hours);
        const dayOfWeek = now.DayOfWeek();

        // Monday-Friday (1-5), 9 AM - 5 PM
        return dayOfWeek >= 1 AND dayOfWeek <= 5
            AND hour >= 9 AND hour < 17;
    }
    then ALLOW
    reason: "Access allowed during business hours"
}

rule CheckAge {
    when {
        const age = user.birthDate.Age();
        return age >= 18;
    }
    then ALLOW
    reason: "User is an adult"
}

rule NightShiftAccess {
    when {
        const currentTime = Time.Now();
        const nightStart = Time.Parse("22:00:00");
        const nightEnd = Time.Parse("06:00:00");

        // Handle time wrapping around midnight
        return currentTime >= nightStart OR currentTime <= nightEnd;
    }
    then ALLOW
}

rule CheckExpiration {
    when {
        const timeUntilExpiry = resource.expiresAt - DateTime.Now();
        const daysUntilExpiry = timeUntilExpiry.TotalDays();

        // Deny if less than 7 days until expiration
        return daysUntilExpiry < 7;
    }
    then DENY
    reason: "Resource expires in less than 7 days"
}

rule EnforceTimeout {
    when {
        const sessionDuration = DateTime.Now() - user.sessionStart;
        const hoursElapsed = sessionDuration.TotalHours();
        const maxHours = 8;

        return hoursElapsed > maxHours;
    }
    then DENY
    reason: "Session timeout after 8 hours"
}

rule CheckRiskScore {
    when {
        // Working with Number arrays
        const scores: Number[] = [
            user.creditScore,
            user.behaviorScore,
            user.reputationScore
        ];

        const avgScore = Math.Avg(scores);  // Returns Decimal
        const minScore = Math.Min(...scores);  // Returns Number
        const totalScore = Math.Sum(scores);  // Returns Number

        // Require average > 70 and no score below 50
        return avgScore > 70.0 AND minScore >= 50;
    }
    then ALLOW
}

rule CalculateTransactionFees {
    when {
        // Working with Decimal arrays
        const fees: Decimal[] = [
            resource.baseFee,
            resource.serviceFee,
            resource.processingFee
        ];

        const totalFees = Math.Sum(fees);  // Returns Decimal
        const avgFee = Math.Avg(fees);     // Returns Decimal

        // Apply 10% discount if total fees exceed threshold
        const discountedTotal = totalFees > 50.0
            ? totalFees * 0.9
            : totalFees;

        return discountedTotal <= user.maxFeeLimit;
    }
    then ALLOW
}

rule LimitTransactionAmount {
    when {
        // Mixed numeric operations
        const dailyTransactions: Decimal[] = user.todayTransactions;
        const dailyTotal = Math.Sum(dailyTransactions);  // Returns Decimal
        const proposedTotal = dailyTotal + resource.amount;

        // Different limits based on user tier
        const limit = user.isPremium ? 10000.0 : 1000.0;

        return proposedTotal > limit;
    }
    then DENY
    reason: "Daily transaction limit exceeded"
}

rule CheckDynamicAttribute {
    when {
        // user.metadata is Map<String, Any>
        if (!Runtime.HasProperty(user.metadata, "clearanceLevel")) {
            return false;
        }

        const clearance = Runtime.GetProperty(user.metadata, "clearanceLevel");
        return clearance >= resource.requiredClearance;
    }
    then ALLOW
}

rule ValidateCustomFields {
    when {
        // Check multiple dynamic properties
        const hasAllFields = Runtime.HasProperty(resource.customData, "approver")
            AND Runtime.HasProperty(resource.customData, "approvalDate")
            AND Runtime.HasProperty(resource.customData, "approvalReason");

        if (!hasAllFields) {
            return false;
        }

        // Validate approval is recent
        const approvalDate = Runtime.GetProperty(resource.customData, "approvalDate");
        const timeSinceApproval = DateTime.Now() - approvalDate;
        return timeSinceApproval.TotalDays() <= 30;
    }
    then ALLOW
}

rule TeamMemberAccess {
    when Relationships.Has(user, "member_of", resource.team)
    then ALLOW
    reason: "User is a team member"
}

rule HierarchicalAccess {
    when {
        // Check if user manages the resource owner
        const manages = Relationships.PathExists(
            user,
            "manages.manages.manages",  // Up to 3 levels
            resource.owner
        );

        return manages AND action == "read";
    }
    then ALLOW
    reason: "Managers can read their reports' resources"
}

rule CollaboratorAccess {
    when {
        // Get the relationship object to check its attributes
        const rel = Relationships.GetRelationship(user, "collaborates_on", resource);
        if (rel == null) {
            return false;
        }

        // Check an attribute on the relationship itself
        const permissions = rel.GetAttribute("permissions");
        return permissions?.Contains("edit") ?? false;
    }
    then ALLOW
}

rule VerifyAPIKey {
    // BEST: Use Verify for password/secret validation
    when Crypto.Verify(context.apiKey, resource.apiKeyHash)
    then ALLOW
    reason: "Valid API key"
}

rule VerifyToken {
    // GOOD: Use constant-time comparison for hashes
    when {
        const providedHash = Crypto.Sha256(context.token + resource.salt);
        return Crypto.ConstantTimeCompare(providedHash, resource.tokenHash);
    }
    then ALLOW
}

// NEVER: Don't use regular comparison for secrets
// when Crypto.Sha256(context.secret) == resource.secretHash  // VULNERABLE TO TIMING ATTACKS!

// .env file:
// ADMIN_ROLE = "system-admin"
// MAINTENANCE_MODE = false
// API_RATE_LIMIT = 1000

rule AdminAccess {
    when env["ADMIN_ROLE"] in user.roles
    then ALLOW
    priority: 1000
}

rule MaintenanceMode {
    when env["MAINTENANCE_MODE"] == true
    then DENY
    priority: 0
    reason: "System under maintenance"
}

rule RateLimit {
    when {
        const limit = env["API_RATE_LIMIT"];
        return user.requestCount > limit;
    }
    then DENY
    reason: "Rate limit exceeded"
}