Last active
July 31, 2024 09:51
-
-
Save sashee/54c166ca5f88bd96b75950970ff48a50 to your computer and use it in GitHub Desktop.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [ | |
| { | |
| "uid": { | |
| "type": "Sample::Project", | |
| "id": "project1" | |
| }, | |
| "attrs": { | |
| "id": "project1" | |
| }, | |
| "parents": [] | |
| }, | |
| { | |
| "uid": { | |
| "type": "Sample::Project", | |
| "id": "project2" | |
| }, | |
| "attrs": { | |
| "id": "project2" | |
| }, | |
| "parents": [] | |
| }, | |
| { | |
| "uid": { | |
| "type": "Sample::Epic", | |
| "id": "epic1" | |
| }, | |
| "attrs": { | |
| "project": {"type": "Sample::Project", "id": "project1"} | |
| }, | |
| "parents": [] | |
| }, | |
| { | |
| "uid": { | |
| "type": "Sample::Ticket", | |
| "id": "ticket1" | |
| }, | |
| "attrs": { | |
| "epic": {"type": "Sample::Epic", "id": "epic1"} | |
| }, | |
| "parents": [] | |
| }, | |
| { | |
| "uid": { | |
| "type": "Sample::Team", | |
| "id": "team1" | |
| }, | |
| "attrs": { | |
| "project": {"type": "Sample::Project", "id": "project1"} | |
| }, | |
| "parents": [] | |
| }, | |
| { | |
| "uid": { | |
| "type": "Sample::User", | |
| "id": "user1" | |
| }, | |
| "attrs": { | |
| "team": {"type": "Sample::Team", "id": "team1"} | |
| }, | |
| "parents": [] | |
| } | |
| ] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <!doctype html> | |
| <html lang="en"> | |
| <head> | |
| <meta charset="utf-8"> | |
| <title>GistRun</title> | |
| </head> | |
| <body> | |
| <pre id="logs"></pre> | |
| <script type="module" src="script.js"></script> | |
| </body> | |
| </html> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| permit( | |
| principal is Sample::User, | |
| action in [Sample::Action::"assignTicket"], | |
| resource | |
| )when { | |
| context.ticket.epic.project.id == principal.team.project.id | |
| }; |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| namespace Sample { | |
| action assignTicket appliesTo { | |
| principal: [User], | |
| resource: User, | |
| context: { | |
| ticket: Ticket | |
| } | |
| }; | |
| entity Admin { | |
| }; | |
| entity Team { | |
| project: Project | |
| }; | |
| entity User { | |
| team: Team | |
| }; | |
| entity Project { | |
| id: String | |
| }; | |
| entity Epic { | |
| project: Project | |
| }; | |
| entity Ticket { | |
| epic: Epic | |
| }; | |
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| import * as cedar from "https://esm.sh/@cedar-policy/cedar-wasm@3.2.3/web"; | |
| const log = (text) => document.querySelector("#logs").innerText += (text + "\n"); | |
| const res = await fetch("https://esm.sh/@cedar-policy/cedar-wasm@3.2.3/web/cedar_wasm_bg.wasm"); | |
| if (!res.ok) { | |
| throw new Error("Could not fetch wasm"); | |
| } | |
| const wasmFile = await res.arrayBuffer(); | |
| console.log(wasmFile) | |
| cedar.initSync(wasmFile); | |
| log("WASM loaded and inited"); | |
| const loadText = async (fileName) => { | |
| const res = await fetch(fileName); | |
| if (!res.ok) { | |
| throw new Error("Could not fetch file: " + fileName); | |
| } | |
| return res.text(); | |
| } | |
| const [schema, policies, entities] = await Promise.all([ | |
| loadText("schema.cedar").then((text) => ({human: text})), | |
| loadText("policies.cedar"), | |
| loadText("entities.json").then((text) => JSON.parse(text)), | |
| ]); | |
| log("schema, policies, entites loaded"); | |
| const p4 = cedar.validate({ | |
| schema, | |
| policySet: policies, | |
| }); | |
| log("validation: " + JSON.stringify(p4, undefined, 4)); | |
| const action = {type: "Sample::Action", id: "assignTicket"}; | |
| const principal = {type: "Sample::User", id: "user1"}; | |
| const resource = {type: "Sample::User", id: "user1"}; | |
| const context = {ticket: {type: "Sample::Ticket", id: "ticket1"}}; | |
| const cedarArgs = {slice: {policies, entities}, schema, principal, action, resource, context}; | |
| console.debug(JSON.stringify(cedarArgs, undefined, 4)); | |
| const cedarRes = cedar.isAuthorized(cedarArgs); | |
| log(JSON.stringify(cedarRes, undefined, 4)); | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment