IAPL schema generation

internal/iapl/default.go

@@ -0,0 +1,214 @@
+package iapl
+
+// DefaultPolicy generates the default policy for permissions-api.
+func DefaultPolicy() Policy {
+	policyDocument := PolicyDocument{
+		ResourceTypes: []ResourceType{
+			{
+				Name:     "role",
+				IDPrefix: "permrol",
+				Relationships: []Relationship{
+					{
+						Relation: "subject",
+						TargetTypeNames: []string{
+							"subject",
+						},
+					},
+				},
+			},
+			{
+				Name:     "user",
+				IDPrefix: "idntusr",
+			},
+			{
+				Name:     "client",
+				IDPrefix: "idntcli",
+			},
+			{
+				Name:     "tenant",
+				IDPrefix: "tnntten",
+				Relationships: []Relationship{
+					{
+						Relation: "parent",
+						TargetTypeNames: []string{
+							"tenant",
+						},
+					},
+				},
+			},
+			{
+				Name:     "loadbalancer",
+				IDPrefix: "loadbal",
+				Relationships: []Relationship{
+					{
+						Relation: "owner",
+						TargetTypeNames: []string{
+							"resourceowner",
+						},
+					},
+				},
+			},
+		},
+		Unions: []Union{
+			{
+				Name: "subject",
+				ResourceTypeNames: []string{
+					"user",
+					"client",
+				},
+			},
+			{
+				Name: "resourceowner",
+				ResourceTypeNames: []string{
+					"tenant",
+				},
+			},
+		},
+		Actions: []Action{
+			{
+				Name: "loadbalancer_create",
+			},
+			{
+				Name: "loadbalancer_get",
+			},
+			{
+				Name: "loadbalancer_list",
+			},
+			{
+				Name: "loadbalancer_update",
+			},
+			{
+				Name: "loadbalancer_delete",
+			},
+		},
+		ActionBindings: []ActionBinding{
+			{
+				ActionName: "loadbalancer_create",
+				TypeName:   "resourceowner",
+				Conditions: []Condition{
+					{
+						RoleBinding: &ConditionRoleBinding{},
+					},
+					{
+						RelationshipAction: &ConditionRelationshipAction{
+							Relation:   "parent",
+							ActionName: "loadbalancer_create",
+						},
+					},
+				},
+			},
+			{
+				ActionName: "loadbalancer_get",
+				TypeName:   "resourceowner",
+				Conditions: []Condition{
+					{
+						RoleBinding: &ConditionRoleBinding{},
+					},
+					{
+						RelationshipAction: &ConditionRelationshipAction{
+							Relation:   "parent",
+							ActionName: "loadbalancer_get",
+						},
+					},
+				},
+			},
+			{
+				ActionName: "loadbalancer_update",
+				TypeName:   "resourceowner",
+				Conditions: []Condition{
+					{
+						RoleBinding: &ConditionRoleBinding{},
+					},
+					{
+						RelationshipAction: &ConditionRelationshipAction{
+							Relation:   "parent",
+							ActionName: "loadbalancer_update",
+						},
+					},
+				},
+			},
+			{
+				ActionName: "loadbalancer_list",
+				TypeName:   "resourceowner",
+				Conditions: []Condition{
+					{
+						RoleBinding: &ConditionRoleBinding{},
+					},
+					{
+						RelationshipAction: &ConditionRelationshipAction{
+							Relation:   "parent",
+							ActionName: "loadbalancer_list",
+						},
+					},
+				},
+			},
+			{
+				ActionName: "loadbalancer_delete",
+				TypeName:   "resourceowner",
+				Conditions: []Condition{
+					{
+						RoleBinding: &ConditionRoleBinding{},
+					},
+					{
+						RelationshipAction: &ConditionRelationshipAction{
+							Relation:   "parent",
+							ActionName: "loadbalancer_delete",
+						},
+					},
+				},
+			},
+			{
+				ActionName: "loadbalancer_get",
+				TypeName:   "loadbalancer",
+				Conditions: []Condition{
+					{
+						RoleBinding: &ConditionRoleBinding{},
+					},
+					{
+						RelationshipAction: &ConditionRelationshipAction{
+							Relation:   "owner",
+							ActionName: "loadbalancer_get",
+						},
+					},
+				},
+			},
+			{
+				ActionName: "loadbalancer_update",
+				TypeName:   "loadbalancer",
+				Conditions: []Condition{
+					{
+						RoleBinding: &ConditionRoleBinding{},
+					},
+					{
+						RelationshipAction: &ConditionRelationshipAction{
+							Relation:   "owner",
+							ActionName: "loadbalancer_update",
+						},
+					},
+				},
+			},
+			{
+				ActionName: "loadbalancer_delete",
+				TypeName:   "loadbalancer",
+				Conditions: []Condition{
+					{
+						RoleBinding: &ConditionRoleBinding{},
+					},
+					{
+						RelationshipAction: &ConditionRelationshipAction{
+							Relation:   "owner",
+							ActionName: "loadbalancer_delete",
+						},
+					},
+				},
+			},
+		},
+	}
+
+	policy := NewPolicy(policyDocument)
+	if err := policy.Validate(); err != nil {
+		panic(err)
+	}
+
+	return policy
+}

internal/iapl/doc.go

@@ -0,0 +1,3 @@
+// Package iapl contains functions and data for the Infratographer Authorization Policy Language, a
+// domain-specific language for defining authorization policies based on resource relationships.
+package iapl

internal/iapl/errors.go

@@ -0,0 +1,16 @@
+package iapl
+
+import "errors"
+
+var (
+	// ErrorTypeExists represents an error where a duplicate type or union was declared.
+	ErrorTypeExists = errors.New("type already exists")
+	// ErrorUnknownType represents an error where a resource type is unknown in the authorization policy.
+	ErrorUnknownType = errors.New("unknown resource type")
+	// ErrorInvalidCondition represents an error where an action binding condition is invalid.
+	ErrorInvalidCondition = errors.New("invalid condition")
+	// ErrorUnknownRelation represents an error where a relation is not defined for a resource type.
+	ErrorUnknownRelation = errors.New("unknown relation")
+	// ErrorUnknownAction represents an error where an action is not defined.
+	ErrorUnknownAction = errors.New("unknown action")
+)