How to properly bind Policy Functions to a scope?

[Patrick-Pr]

Hello all,

I have a question about the binding of a function which should enforce a policy to a scope.

I used the sample which can be found here as reference. Which is a bit out of date because a method and constant used are deprecated in 0.10.1 but I hoped that the methodology would still be the way to go.

Now to my issue I wrote a ServiceExtension which binds a key https://w3id.org/edc/v0.0.1/ns/something to the contract.negotiation scope and a function under the same key also to the previous mentioned scope.

public class PolicyFunctionsExtension implements ServiceExtension {
    private static final String LOCATION_CONSTRAINT_KEY = "https://w3id.org/edc/v0.0.1/ns/something";

    @Inject
    private RuleBindingRegistry ruleBindingRegistry;
    
    @Inject
    private PolicyEngine policyEngine;

    @Override
    public String name() {
        return "PolicyFunctions";
    }

    @Override
    public void initialize(ServiceExtensionContext context) {
        var monitor = context.getMonitor();
        monitor.info("Initializing PolicyFunctionsExtension!!!");


        ruleBindingRegistry.bind(LOCATION_CONSTRAINT_KEY, NEGOTIATION_SCOPE);
        policyEngine.registerFunction(ContractNegotiationPolicyContext.class, Permission.class, LOCATION_CONSTRAINT_KEY, (op, rv, duty, ctx) -> {

            monitor.info("right Value " + rv.toString());
            monitor.info("operator " + op.toString());
            monitor.info("rule " + duty.toString());
            monitor.info("context " + ctx.scope());

            return switch (op) {
                case EQ -> rv.equals("rus");
                default -> false;
            };
        });
        
    }
}

I can clearly see the info log with the message Initializing PolicyFunctionsExtension!!! therefore my assumption is that the key and function should be bound.

To test this I send a request to the consumer http://localhost:29193/management/v3/contractnegotiations which is looking like this

{
  "@context": {
    "@vocab": "https://w3id.org/edc/v0.0.1/ns/"
  },
  "@type": "ContractRequest",
  "counterPartyAddress": "http://localhost:19194/protocol",
  "protocol": "dataspace-protocol-http",
  "policy": {
    "@context": "http://www.w3.org/ns/odrl.jsonld",
    "@id": "1:test-document:h",
    "@type": "Offer",
    "permission": [
      {
        "action": "use",
        "constraint": {
          "@type": "AtomicConstraint",
          "leftOperand": "something",
          "operator": {
              "@id": "odrl:eq"
          },
          "rightOperand": "eu"
        }
      }
    ],
    "assigner": "provider-a7d4baff-25f8-462a-90f4-2fb834bfe521",
    "target": "test-document"
  }
}

In following this I can see in the logs the negotiation process happening but there are no signs of the function I thought I bound earlier. Furthermore if I try to debug into the checking function the debugger does not pause which tells me that it is not called.

Following a snippet of the log

DEBUG 2025-01-22T11:07:06.996207 DSP: Incoming CatalogRequestMessage for class org.eclipse.edc.connector.controlplane.catalog.spi.Catalog process
DEBUG 2025-01-22T11:07:13.366929 [DataPlaneSelectorManagerImpl] DataPlaneInstance a7d4baff-25f8-462a-90f4-2fb834bfe521 is now in state AVAILABLE
DEBUG 2025-01-22T11:07:13.376862 DSP: Incoming ContractRequestMessage for class org.eclipse.edc.connector.controlplane.contract.spi.types.negotiation.ContractNegotiation process
DEBUG 2025-01-22T11:07:13.382475 [PROVIDER] ContractNegotiation 8fcddff4-ca3a-4e05-96e8-e03875043ff8 is now in state REQUESTED.
DEBUG 2025-01-22T11:07:14.393479 [ProviderContractNegotiationManagerImpl] ContractNegotiation 8fcddff4-ca3a-4e05-96e8-e03875043ff8 is now in state AGREEING
DEBUG 2025-01-22T11:07:14.398369 ContractNegotiation: ID 8fcddff4-ca3a-4e05-96e8-e03875043ff8. [Provider] send agreement
DEBUG 2025-01-22T11:07:14.411694 ContractNegotiation: ID 8fcddff4-ca3a-4e05-96e8-e03875043ff8. [Provider] send agreement
DEBUG 2025-01-22T11:07:14.415488 [ProviderContractNegotiationManagerImpl] ContractNegotiation 8fcddff4-ca3a-4e05-96e8-e03875043ff8 is now in state AGREED
DEBUG 2025-01-22T11:07:15.419993 DSP: Incoming ContractAgreementVerificationMessage for class org.eclipse.edc.connector.controlplane.contract.spi.types.negotiation.ContractNegotiation process: 8fcddff4-ca3a-4e05-96e8-e03875043ff8
DEBUG 2025-01-22T11:07:15.426573 [PROVIDER] ContractNegotiation 8fcddff4-ca3a-4e05-96e8-e03875043ff8 is now in state VERIFIED.
DEBUG 2025-01-22T11:07:16.437725 [ProviderContractNegotiationManagerImpl] ContractNegotiation 8fcddff4-ca3a-4e05-96e8-e03875043ff8 is now in state FINALIZING
DEBUG 2025-01-22T11:07:16.440518 ContractNegotiation: ID 8fcddff4-ca3a-4e05-96e8-e03875043ff8. [Provider] send finalization
DEBUG 2025-01-22T11:07:16.448874 ContractNegotiation: ID 8fcddff4-ca3a-4e05-96e8-e03875043ff8. [Provider] send finalization
DEBUG 2025-01-22T11:07:16.452016 [ProviderContractNegotiationManagerImpl] ContractNegotiation 8fcddff4-ca3a-4e05-96e8-e03875043ff8 is now in state FINALIZED

I also checked the leftOperand which value looks like this https://w3id.org/edc/v0.0.1/ns/something from my understanding the key I should use during the binding have to match the value of the leftOperand.

private static final String LOCATION_CONSTRAINT_KEY = "https://w3id.org/edc/v0.0.1/ns/something";

I am currently a bit clueless on which mistake I could have made during the binding or what information on the process I am missing.

I hope you can shed some light on this for me.
Than you in advance.

[wolf4ood]

From a quick look i think you forgot to register the use action into scopes

ruleBindingRegistry.bind(ODRL_USE_ACTION_ATTRIBUTE, ALL_SCOPES);

as the pointed example

[Patrick-Pr]

Thank you that was the solution. I didn't know that I need to bind the action to a Scope aswell.

Do you know any point where this information could be documented?

[Patrick-Pr]

I guess I have a somewhat related followup question.

In the request for negotiation http://localhost:29193/management/v3/contractnegotiations

{
  "@context": {
    "@vocab": "https://w3id.org/edc/v0.0.1/ns/"
  },
  "@type": "ContractRequest",
  "counterPartyAddress": "http://localhost:19194/protocol",
  "protocol": "dataspace-protocol-http",
  "policy": {
    "@context": "http://www.w3.org/ns/odrl.jsonld",
    "@id": "1:test-document:h",
    "@type": "Offer",
    "permission": [
      {
        "action": "use",
        "constraint": {
          "@type": "AtomicConstraint",
          "leftOperand": "something",
          "operator": {
              "@id": "odrl:eq"
          },
          "rightOperand": "eu"
        }
      }
    ],
    "assigner": "provider-a7d4baff-25f8-462a-90f4-2fb834bfe521",
    "target": "test-document"
  }
}

the right operand in this case eu or the whole object in the permission array. Must this always be the same as the policy definition?

I.e i have the following policy definition

  {
    "@id": "eu-policy",
    "@type": "PolicyDefinition",
    "createdAt": 1737384563306,
    "policy": {
      "@id": "eed4cfcf-63b4-497a-9977-6382c3ca28ab",
      "@type": "odrl:Set",
      "odrl:permission": {
        "odrl:action": {
          "@id": "odrl:use"
        },
        "odrl:constraint": {
          "odrl:leftOperand": {
            "@id": "edc:something"
          },
          "odrl:operator": {
            "@id": "odrl:eq"
          },
          "odrl:rightOperand": "jjsdfkl;sjd;fl"
        }
      },
      "odrl:prohibition": [],
      "odrl:obligation": []
    },
    "@context": {
      "adv": "https://advaneo.de/dspace/1.0/",
      "@vocab": "https://w3id.org/edc/v0.0.1/ns/",
      "edc": "https://w3id.org/edc/v0.0.1/ns/",
      "odrl": "http://www.w3.org/ns/odrl/2/"
    }
  }

can I or should I provide the value to check with a Rule Function in the negotiation request above within the rightOperand value?
I did not found documentation on this topic for me it looks like that the permission constraint is just repeated and has to contain the same values as in the PolicyDefinition but if this is the case where should i put the values which I want to check for example a location or a member status or else.