Repository: meta-llama/llama-stack
File: src/llama_stack/core/access_control/conditions.py (Python)

Code before:
        self.value = value

    def matches(self, resource: ProtectedResource, user: User) -> bool:
        if user.attributes and self.name in user.attributes:
            return self.value in user.attributes[self.name]
        print(f"User does not have {self.value} in {self.name}")
        return False

    def __repr__(self):
        return f"user with {self.value} in {self.name}"


class UserWithValueNotInList(UserWithValueInList):
    def __init__(self, name: str, value: str):
        super().__init__(name, value)

    def matches(self, resource: ProtectedResource, user: User) -> bool:
        return not super().matches(resource, user)

    def __repr__(self):
        return f"user with {self.value} not in {self.name}"


class UserIsOwner:
    def matches(self, resource: ProtectedResource, user: User) -> bool:
        return resource.owner.principal == user.principal if resource.owner else True

    def __repr__(self):
        return "user is owner"


class UserIsNotOwner:
    def matches(self, resource: ProtectedResource, user: User) -> bool:
        return not resource.owner or resource.owner.principal != user.principal

    def __repr__(self):
        return "user is not owner"


def parse_condition(condition: str) -> Condition:
    words = condition.split()
    match words:
        case ["user", "is", "owner"]:
            return UserIsOwner()
        case ["user", "is", "not", "owner"]:
            return UserIsNotOwner()
        case ["user", "with", value, "in", name]:
            return UserWithValueInList(name, value)
        case ["user", "with", value, "not", "in", name]:
            return UserWithValueNotInList(name, value)
        case ["user", "in", "owners", name]:

Review comment (suggestion):
I'm questioning the wisdom of this, As is above 
UserIsOwner passes if User is the owner OR the resource has no owner (public)

I wonder if we should have a new rule(UserIsNull)
UserIsOwner: passes if User is the owner 
UserIsNull:the resource has no owner (public)

Code after:
        self.value = value

    def matches(self, resource: ProtectedResource, user: User) -> bool:
        if user.attributes and self.name in user.attributes:
            return self.value in user.attributes[self.name]
        print(f"User does not have {self.value} in {self.name}")
        return False

    def __repr__(self):
        return f"user with {self.value} in {self.name}"


class UserWithValueNotInList(UserWithValueInList):
    def __init__(self, name: str, value: str):
        super().__init__(name, value)

    def matches(self, resource: ProtectedResource, user: User) -> bool:
        return not super().matches(resource, user)

    def __repr__(self):
        return f"user with {self.value} not in {self.name}"


class UserIsOwner:
    def matches(self, resource: ProtectedResource, user: User) -> bool:
        return resource.owner.principal == user.principal if resource.owner else False

    def __repr__(self):
        return "user is owner"


class UserIsNotOwner:
    def matches(self, resource: ProtectedResource, user: User) -> bool:
        return not resource.owner or resource.owner.principal != user.principal

    def __repr__(self):
        return "user is not owner"


class ResourceIsUnowned:
    def matches(self, resource: ProtectedResource, user: User) -> bool:
        return not resource.owner

    def __repr__(self):
        return "resource is unowned"


def parse_condition(condition: str) -> Condition:
    words = condition.split()
    match words:
        case ["user", "is", "owner"]: