feat: Add ACL list support to rego objects

coder · sreya · Sep 13, 2022 · Sep 13, 2022 · Sep 13, 2022 · Sep 15, 2022
commit 5a47132313b5280381106bfcac249ea3f8d0e0b0
@@ -191,6 +191,19 @@ func TestAuthorizeDomain(t *testing.T) {
 		},
 	}
 
+	testAuthorize(t, "ACLList", user, []authTestCase{
+		{
+			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(unuseID).WithACL(map[Action][]string{
+				ActionRead:   {user.UserID},
+				ActionDelete: {user.UserID},
+				ActionCreate: {user.UserID},
+				ActionUpdate: {user.UserID},
+			}),
+			actions: allActions(),
+			allow:   true,
+		},
+	})
+
 	testAuthorize(t, "Member", user, []authTestCase{
 		// Org + me
 		{resource: ResourceWorkspace.InOrg(defOrg).WithOwner(user.UserID), actions: allActions(), allow: true},

@@ -63,8 +63,8 @@ var (
 			return Role{
 				Name:        owner,
 				DisplayName: "Owner",
-				Site: permissions(map[Object][]Action{
-					ResourceWildcard: {WildcardSymbol},
+				Site: permissions(map[string][]Action{
+					ResourceWildcard.Type: {WildcardSymbol},
 				}),
 			}
 		},
@@ -74,15 +74,15 @@ var (
 			return Role{
 				Name:        member,
 				DisplayName: "",
-				Site: permissions(map[Object][]Action{
+				Site: permissions(map[string][]Action{
 					// All users can read all other users and know they exist.
-					ResourceUser:           {ActionRead},
-					ResourceRoleAssignment: {ActionRead},
+					ResourceUser.Type:           {ActionRead},
+					ResourceRoleAssignment.Type: {ActionRead},
 					// All users can see the provisioner daemons.
-					ResourceProvisionerDaemon: {ActionRead},
+					ResourceProvisionerDaemon.Type: {ActionRead},
 				}),
-				User: permissions(map[Object][]Action{
-					ResourceWildcard: {WildcardSymbol},
+				User: permissions(map[string][]Action{
+					ResourceWildcard.Type: {WildcardSymbol},
 				}),
 			}
 		},
@@ -94,11 +94,11 @@ var (
 			return Role{
 				Name:        auditor,
 				DisplayName: "Auditor",
-				Site: permissions(map[Object][]Action{
+				Site: permissions(map[string][]Action{
 					// Should be able to read all template details, even in orgs they
 					// are not in.
-					ResourceTemplate: {ActionRead},
-					ResourceAuditLog: {ActionRead},
+					ResourceTemplate.Type: {ActionRead},
+					ResourceAuditLog.Type: {ActionRead},
 				}),
 			}
 		},
@@ -107,13 +107,13 @@ var (
 			return Role{
 				Name:        templateAdmin,
 				DisplayName: "Template Admin",
-				Site: permissions(map[Object][]Action{
-					ResourceTemplate: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
+				Site: permissions(map[string][]Action{
+					ResourceTemplate.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
 					// CRUD all files, even those they did not upload.
-					ResourceFile:      {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
-					ResourceWorkspace: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
+					ResourceFile.Type:      {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
+					ResourceWorkspace.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
 					// CRUD to provisioner daemons for now.
-					ResourceProvisionerDaemon: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
+					ResourceProvisionerDaemon.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
 				}),
 			}
 		},
@@ -122,11 +122,11 @@ var (
 			return Role{
 				Name:        userAdmin,
 				DisplayName: "User Admin",
-				Site: permissions(map[Object][]Action{
-					ResourceRoleAssignment: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
-					ResourceUser:           {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
+				Site: permissions(map[string][]Action{
+					ResourceRoleAssignment.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
+					ResourceUser.Type:           {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
 					// Full perms to manage org members
-					ResourceOrganizationMember: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
+					ResourceOrganizationMember.Type: {ActionCreate, ActionRead, ActionUpdate, ActionDelete},
 				}),
 			}
 		},
@@ -390,14 +390,14 @@ func roleSplit(role string) (name string, orgID string, err error) {
 
 // permissions is just a helper function to make building roles that list out resources
 // and actions a bit easier.
-func permissions(perms map[Object][]Action) []Permission {
+func permissions(perms map[string][]Action) []Permission {
 	list := make([]Permission, 0, len(perms))
-	for k, actions := range perms {
+	for objectType, actions := range perms {
 		for _, act := range actions {
 			act := act
 			list = append(list, Permission{
 				Negate:       false,
-				ResourceType: k.Type,
+				ResourceType: objectType,
 				Action:       act,
 			})
 		}

@@ -138,7 +138,9 @@ type Object struct {
 
 	// Type is "workspace", "project", "app", etc
 	Type string `json:"type"`
-	// TODO: SharedUsers?
+
+	// map[action][]user_id
+	ACLList map[Action][]string ` json:"acl_list"`
 }
 
 func (z Object) RBACObject() Object {
@@ -171,3 +173,13 @@ func (z Object) WithOwner(ownerID string) Object {
 		Type:  z.Type,
 	}
 }
+
+// WithACL adds an ACL list to a given object
+func (z Object) WithACL(acl map[Action][]string) Object {
+	return Object{
+		Owner:   z.Owner,
+		OrgID:   z.OrgID,
+		Type:    z.Type,
+		ACLList: acl,
+	}
+}
@@ -43,6 +43,7 @@ func newPartialAuthorizer(ctx context.Context, subjectID string, roles []Role, a
 		rego.Unknowns([]string{
 			"input.object.owner",
 			"input.object.org_owner",
+			"input.object.acl_list",
 		}),
 		rego.Input(input),
 	).Partial(ctx)

@@ -3,7 +3,7 @@ import future.keywords
 # A great playground: https://play.openpolicyagent.org/
 # Helpful cli commands to debug.
 # opa eval --format=pretty 'data.authz.allow = true' -d policy.rego  -i input.json
-# opa eval --partial --format=pretty 'data.authz.allow = true' -d policy.rego --unknowns input.object.owner --unknowns input.object.org_owner -i input.json
+# opa eval --partial --format=pretty 'data.authz.allow = true' -d policy.rego --unknowns input.object.owner --unknowns input.object.org_owner --unknowns input.object.acl_list -i input.json
 
 #
 # This policy is specifically constructed to compress to a set of queries if the
@@ -156,3 +156,10 @@ allow {
 	org_mem
 	user = 1
 }
+
+# ACL Allow
+allow {
+	# Should you have to be a member of the org too?
+	input.subject.id in input.object.acl_list[input.action]
+}
+