Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

IAPL schema generation #106

Merged
merged 14 commits into from
Jun 15, 2023
Merged
214 changes: 214 additions & 0 deletions internal/iapl/default.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,214 @@
package iapl

// DefaultPolicy generates the default policy for permissions-api.
func DefaultPolicy() Policy {
policyDocument := PolicyDocument{
ResourceTypes: []ResourceType{
{
Name: "role",
IDPrefix: "idenrol",
mikemrm marked this conversation as resolved.
Show resolved Hide resolved
Relationships: []Relationship{
{
Relation: "subject",
TargetTypeNames: []string{
"subject",
},
},
},
},
{
Name: "user",
IDPrefix: "idenusr",
},
{
Name: "client",
IDPrefix: "idencli",
},
{
Name: "tenant",
IDPrefix: "identen",
mikemrm marked this conversation as resolved.
Show resolved Hide resolved
Relationships: []Relationship{
{
Relation: "parent",
TargetTypeNames: []string{
"tenant",
},
},
},
},
{
Name: "loadbalancer",
IDPrefix: "loadbal",
Relationships: []Relationship{
{
Relation: "owner",
TargetTypeNames: []string{
"resourceowner",
},
},
},
},
},
Unions: []Union{
{
Name: "subject",
ResourceTypeNames: []string{
"user",
"client",
},
},
{
Name: "resourceowner",
ResourceTypeNames: []string{
"tenant",
},
},
},
Actions: []Action{
{
Name: "loadbalancer_create",
},
{
Name: "loadbalancer_get",
},
{
Name: "loadbalancer_list",
},
{
Name: "loadbalancer_update",
},
{
Name: "loadbalancer_delete",
},
},
ActionBindings: []ActionBinding{
{
ActionName: "loadbalancer_create",
TypeName: "resourceowner",
Conditions: []Condition{
{
RoleBinding: &ConditionRoleBinding{},
},
{
RelationshipAction: &ConditionRelationshipAction{
Relation: "parent",
ActionName: "loadbalancer_create",
},
},
},
},
{
ActionName: "loadbalancer_get",
TypeName: "resourceowner",
Conditions: []Condition{
{
RoleBinding: &ConditionRoleBinding{},
},
{
RelationshipAction: &ConditionRelationshipAction{
Relation: "parent",
ActionName: "loadbalancer_get",
},
},
},
},
{
ActionName: "loadbalancer_update",
TypeName: "resourceowner",
Conditions: []Condition{
{
RoleBinding: &ConditionRoleBinding{},
},
{
RelationshipAction: &ConditionRelationshipAction{
Relation: "parent",
ActionName: "loadbalancer_update",
},
},
},
},
{
ActionName: "loadbalancer_list",
TypeName: "resourceowner",
Conditions: []Condition{
{
RoleBinding: &ConditionRoleBinding{},
},
{
RelationshipAction: &ConditionRelationshipAction{
Relation: "parent",
ActionName: "loadbalancer_list",
},
},
},
},
{
ActionName: "loadbalancer_delete",
TypeName: "resourceowner",
Conditions: []Condition{
{
RoleBinding: &ConditionRoleBinding{},
},
{
RelationshipAction: &ConditionRelationshipAction{
Relation: "parent",
ActionName: "loadbalancer_delete",
},
},
},
},
{
ActionName: "loadbalancer_get",
TypeName: "loadbalancer",
Conditions: []Condition{
{
RoleBinding: &ConditionRoleBinding{},
},
{
RelationshipAction: &ConditionRelationshipAction{
Relation: "owner",
ActionName: "loadbalancer_get",
},
},
},
},
{
ActionName: "loadbalancer_update",
TypeName: "loadbalancer",
Conditions: []Condition{
{
RoleBinding: &ConditionRoleBinding{},
},
{
RelationshipAction: &ConditionRelationshipAction{
Relation: "owner",
ActionName: "loadbalancer_update",
},
},
},
},
{
ActionName: "loadbalancer_delete",
TypeName: "loadbalancer",
Conditions: []Condition{
{
RoleBinding: &ConditionRoleBinding{},
},
{
RelationshipAction: &ConditionRelationshipAction{
Relation: "owner",
ActionName: "loadbalancer_delete",
},
},
},
},
},
}

policy := NewPolicy(policyDocument)
if err := policy.Validate(); err != nil {
panic(err)
}

return policy
}
3 changes: 3 additions & 0 deletions internal/iapl/doc.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
// Package iapl contains functions and data for the Infratographer Authorization Policy Language, a
// domain-specific language for defining authorization policies based on resource relationships.
package iapl
16 changes: 16 additions & 0 deletions internal/iapl/errors.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
package iapl

import "errors"

var (
// ErrorUnknownType represents an error where a resource type is unknown in the authorization policy.
ErrorUnknownType = errors.New("unknown resource type")
// ErrorInvalidAlias represents an error where a type alias is invalid.
ErrorInvalidAlias = errors.New("invalid type alias")
mikemrm marked this conversation as resolved.
Show resolved Hide resolved
// ErrorInvalidCondition represents an error where an action binding condition is invalid.
ErrorInvalidCondition = errors.New("invalid condition")
// ErrorUnknownRelation represents an error where a relation is not defined for a resource type.
ErrorUnknownRelation = errors.New("unknown relation")
// ErrorUnknownAction represents an error where an action is not defined.
ErrorUnknownAction = errors.New("unknown action")
)
Loading