To handle nested claims.

[tle15]

Claims are in nested and in the following format:

"x-ms-azurevm-os-provisioning": {
"node-policy-identity": {
"eventVersion": "1",
"policyId": "openai-whisper",
"signer": "8fe6e7a314b8695b21710cebf0265e8d7bbaabde26f431c407faf16fcbd6b924",
"svn": "1"
},
"os-image-identity": {
"diskId": "singularity.ubuntu-22.04",
"eventVersion": "1",
"signer": "f9cce5b7bdc2aaacfc4c78cb2b7515459aded8149287b74667bb2f178b0cf7b9",
"svn": "1"
}

[beejones]

This is the current test key release policy caught from the debug endpoint:
{
"type": "add",
"claims": {
"x-ms-ver": [
"1.0"
],
"x-ms-azurevm-debuggersdisabled": [
true
],
"x-ms-azurevm-osversion-major": [
22,
23
],
"x-ms-azurevm-os-provisioning": [
{
"node-policy-identity": {
"eventVersion": "1",
"policyId": "openai-whisper",
"signer": "8fe6e7a314b8695b21710cebf0265e8d7bbaabde26f431c407faf16fcbd6b924"
}
},
{
"node-policy-identity": {
"eventVersion": "2",
"policyId": "openai-whisper",
"signer": "8fe6e7a314b8695b21710cebf0265e8d7bbaabde26f431c407faf16fcbd6b924"
}
}
]
},
"gte": {
"x-ms-azurevm-osversion-major": "22"
},
"gt": {
"x-ms-azurevm-osversion-major": 21
}
}

There are two node-policy-identity claims with different values. This policy will not release a key because this claim is not present in your test token:
"node-policy-identity": {
"eventVersion": "2",

[beejones]

where are these claims tested when they appear in a KRP?

[beejones]

I believe this will eventually become very confusing. E.g. policyId is a claim that we want to compare on value while eventVersion is typically a gte check.
If we use flattened claims it will be clearer and we can easily check if these claim is allowed in CLAIMS:
"x-ms-azurevm-os-provisioning.node-policy-identity.eventVersion"
"x-ms-azurevm-os-provisioning.node-policy-identity.policyId"

[beejones]

We will need unit tests to test the new functionality. See npm run test.
They tests added by Yu are failing. I fixed them but I need to sync.

[beejones]

I believe this will eventually become very confusing. E.g. policyId is a claim that we want to compare on value while eventVersion is typically a gte check.
If we use flattened claims it will be clearer and we can easily check if these claim is allowed in CLAIMS:
"x-ms-azurevm-os-provisioning.node-policy-identity.eventVersion"
"x-ms-azurevm-os-provisioning.node-policy-identity.policyId"

[beejones]

in the non-flattened model we should test if the key represents an object and than drill down in the object to check presence in CLAIMS. Way harder than using flattened claims.

[beejones]

I have removed the necessity to add an issuer in code. This will not scale. I will sync my changes so we do no longer need this

[beejones]

same here

[beejones]

I am having build errors doing make build

[tle15]

This is the current test key release policy caught from the debug endpoint: { "type": "add", "claims": { "x-ms-ver": [ "1.0" ], "x-ms-azurevm-debuggersdisabled": [ true ], "x-ms-azurevm-osversion-major": [ 22, 23 ], "x-ms-azurevm-os-provisioning": [ { "node-policy-identity": { "eventVersion": "1", "policyId": "openai-whisper", "signer": "8fe6e7a314b8695b21710cebf0265e8d7bbaabde26f431c407faf16fcbd6b924" } }, { "node-policy-identity": { "eventVersion": "2", "policyId": "openai-whisper", "signer": "8fe6e7a314b8695b21710cebf0265e8d7bbaabde26f431c407faf16fcbd6b924" } } ] }, "gte": { "x-ms-azurevm-osversion-major": "22" }, "gt": { "x-ms-azurevm-osversion-major": 21 } }

There are two node-policy-identity claims with different values. This policy will not release a key because this claim is not present in your test token: "node-policy-identity": { "eventVersion": "2",

It should be OR instead of AND, similar to this case: "x-ms-azurevm-osversion-major": [22,23]. So, the token should be valid.